Overview
overview
10Static
static
3d44580ffdb...82.exe
windows7-x64
1d44580ffdb...82.exe
windows10-2004-x64
10dpp.dll
windows7-x64
3dpp.dll
windows10-2004-x64
5libcrypto-1_1.dll
windows7-x64
1libcrypto-1_1.dll
windows10-2004-x64
3libsodium.dll
windows7-x64
1libsodium.dll
windows10-2004-x64
1libssl-1_1.dll
windows7-x64
1libssl-1_1.dll
windows10-2004-x64
1opus.dll
windows7-x64
1opus.dll
windows10-2004-x64
1zlib1.dll
windows7-x64
3zlib1.dll
windows10-2004-x64
3Analysis
-
max time kernel
1708s -
max time network
1164s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07-07-2023 07:29
Static task
static1
Behavioral task
behavioral1
Sample
d44580ffdb610f1e16bb1aa1-1671885c0c25bc69333368a6-cd55441bbeb4517f30766c0e80428782.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
d44580ffdb610f1e16bb1aa1-1671885c0c25bc69333368a6-cd55441bbeb4517f30766c0e80428782.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
dpp.dll
Resource
win7-20230703-en
Behavioral task
behavioral4
Sample
dpp.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
libcrypto-1_1.dll
Resource
win7-20230703-en
Behavioral task
behavioral6
Sample
libcrypto-1_1.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
libsodium.dll
Resource
win7-20230703-en
Behavioral task
behavioral8
Sample
libsodium.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
libssl-1_1.dll
Resource
win7-20230703-en
Behavioral task
behavioral10
Sample
libssl-1_1.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
opus.dll
Resource
win7-20230705-en
Behavioral task
behavioral12
Sample
opus.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
zlib1.dll
Resource
win7-20230703-en
Behavioral task
behavioral14
Sample
zlib1.dll
Resource
win10v2004-20230703-en
General
-
Target
libcrypto-1_1.dll
-
Size
2.5MB
-
MD5
31643a6540ba24cf98a97cef42634048
-
SHA1
0206d691eaa40885713327c11e000cb771a21703
-
SHA256
e36557189986f864b35c4f3d66b3356ce242c73217ec9ec5c3d66453c480633f
-
SHA512
5f5c74fecacb723126ff099ad7303af500b5125ecef2966fb3104d3668d07e836266680a7628a63a5a26200f6139bed77e7f5c7533a9934cb81be9857800de41
-
SSDEEP
49152:cmjrvGvz67Ltvwm98Iq1CPwDv3uFfJIfAE3C:cmjbXLim98b1CPwDv3uFfJ
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 436 756 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1272 wrote to memory of 756 1272 rundll32.exe rundll32.exe PID 1272 wrote to memory of 756 1272 rundll32.exe rundll32.exe PID 1272 wrote to memory of 756 1272 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 6323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 756 -ip 7561⤵