Analysis
-
max time kernel
15s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24/04/2023, 20:06
Behavioral task
behavioral1
Sample
NewVersionUnlimited/Desktop_Full/Setup_x64.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
NewVersionUnlimited/Desktop_Full/Setup_x64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
NewVersionUnlimited/Desktop_Full/modules.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
NewVersionUnlimited/Desktop_Full/modules.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
NewVersionUnlimited/Desktop_Full/platforms/qwindows.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
NewVersionUnlimited/Desktop_Full/platforms/qwindows.dll
Resource
win10v2004-20230220-en
General
-
Target
NewVersionUnlimited/Desktop_Full/modules.dll
-
Size
907KB
-
MD5
dc05f0b8f1a32e872721d3486e6332b8
-
SHA1
dbf055b0f934640fadcfaa93971fead8df7a3869
-
SHA256
37ec5f998a5c376d4fcd4342b43a4163d1f043e0f7711e46677cd30013882723
-
SHA512
0f89d713237ef11a1ef8d824ad9767bb13fb4f5f334acdd65af0ba6e54cec4a910398636683254b3fe4d46a069a1781187313684ff827a907b8b968134f6efa0
-
SSDEEP
24576:z0OY4ZFajHYDTR2yfVbf+c6Z5WODYsHh6g3P0zAk75:z0CZFaj4HR2yfVbd6Z5WODYsHh6g3P03
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2036 1736 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2036 1736 rundll32.exe 27 PID 1736 wrote to memory of 2036 1736 rundll32.exe 27 PID 1736 wrote to memory of 2036 1736 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NewVersionUnlimited\Desktop_Full\modules.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1736 -s 922⤵
- Program crash
PID:2036
-