Overview
overview
10Static
static
3d44580ffdb...82.exe
windows7-x64
1d44580ffdb...82.exe
windows10-2004-x64
10dpp.dll
windows7-x64
3dpp.dll
windows10-2004-x64
5libcrypto-1_1.dll
windows7-x64
1libcrypto-1_1.dll
windows10-2004-x64
3libsodium.dll
windows7-x64
1libsodium.dll
windows10-2004-x64
1libssl-1_1.dll
windows7-x64
1libssl-1_1.dll
windows10-2004-x64
1opus.dll
windows7-x64
1opus.dll
windows10-2004-x64
1zlib1.dll
windows7-x64
3zlib1.dll
windows10-2004-x64
3Analysis
-
max time kernel
1608s -
max time network
1613s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
07-07-2023 07:29
Static task
static1
Behavioral task
behavioral1
Sample
d44580ffdb610f1e16bb1aa1-1671885c0c25bc69333368a6-cd55441bbeb4517f30766c0e80428782.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
d44580ffdb610f1e16bb1aa1-1671885c0c25bc69333368a6-cd55441bbeb4517f30766c0e80428782.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
dpp.dll
Resource
win7-20230703-en
Behavioral task
behavioral4
Sample
dpp.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
libcrypto-1_1.dll
Resource
win7-20230703-en
Behavioral task
behavioral6
Sample
libcrypto-1_1.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
libsodium.dll
Resource
win7-20230703-en
Behavioral task
behavioral8
Sample
libsodium.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
libssl-1_1.dll
Resource
win7-20230703-en
Behavioral task
behavioral10
Sample
libssl-1_1.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
opus.dll
Resource
win7-20230705-en
Behavioral task
behavioral12
Sample
opus.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
zlib1.dll
Resource
win7-20230703-en
Behavioral task
behavioral14
Sample
zlib1.dll
Resource
win10v2004-20230703-en
General
-
Target
dpp.dll
-
Size
1.9MB
-
MD5
692026ff118997f30b9c314df54bce25
-
SHA1
a09c770f410ad4df8e78c6d0723f70521cfb63f1
-
SHA256
75c5725344092eb7a9f0c2c74c85a98f73d7d4c8201a677b206c35655c2e33d8
-
SHA512
60d5b1b29e19150636a0b7c593e95bac2bc42c0cc2dd6335cc45794f64fc5f64044f64365a9ef742616ffc025e121f2455425808a44add02bb28173394b87e36
-
SSDEEP
24576:myAuvuKXRiZAhSso8JceUkeo4YUPyGdT0QP5YYM5RaIz7pMqijwG0Vzcd00:myvXawC6UkZ4YUtzPSYES0Vzcd00
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2940 1460 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3016 wrote to memory of 1460 3016 rundll32.exe rundll32.exe PID 3016 wrote to memory of 1460 3016 rundll32.exe rundll32.exe PID 3016 wrote to memory of 1460 3016 rundll32.exe rundll32.exe PID 3016 wrote to memory of 1460 3016 rundll32.exe rundll32.exe PID 3016 wrote to memory of 1460 3016 rundll32.exe rundll32.exe PID 3016 wrote to memory of 1460 3016 rundll32.exe rundll32.exe PID 3016 wrote to memory of 1460 3016 rundll32.exe rundll32.exe PID 1460 wrote to memory of 2940 1460 rundll32.exe WerFault.exe PID 1460 wrote to memory of 2940 1460 rundll32.exe WerFault.exe PID 1460 wrote to memory of 2940 1460 rundll32.exe WerFault.exe PID 1460 wrote to memory of 2940 1460 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dpp.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dpp.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 2403⤵
- Program crash