Resubmissions
27-11-2023 06:49
231127-hlvpcseh82 327-11-2023 06:47
231127-hkm8wseg81 321-11-2023 16:06
231121-tkjfgsfe62 321-11-2023 16:06
231121-tj267sgc2z 321-11-2023 10:08
231121-l571ksdg28 3Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
21-11-2023 10:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
inf2.dll
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
inf2.dll
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
inf2.dll
-
Size
1.1MB
-
MD5
491de488716811cf6c432a435a413688
-
SHA1
469567c2bf172c4e0d270b085ae9acaf0559c066
-
SHA256
eead7f5b6f1282ad988238cc8c39292fa99ea416f7793038a20e5caabe93112a
-
SHA512
b7957da02eefa228900bbe1f3c1a5080c142be8d4311c748e921241ade7e4f3ae975d654464939d705a96d0bdcd7e94974fdb74ecc44b1a283c0ea47c894bb24
-
SSDEEP
24576:j0LPo6+J+dxYv7IQF8Z+nZlFlMfNpRYKrHabx6SqoUTb5dXGredODkYgn4iD0:Oo6+J+dxYv7II8bExk3XGredOR1iY
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2676 2784 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2968 wrote to memory of 2784 2968 rundll32.exe rundll32.exe PID 2968 wrote to memory of 2784 2968 rundll32.exe rundll32.exe PID 2968 wrote to memory of 2784 2968 rundll32.exe rundll32.exe PID 2968 wrote to memory of 2784 2968 rundll32.exe rundll32.exe PID 2968 wrote to memory of 2784 2968 rundll32.exe rundll32.exe PID 2968 wrote to memory of 2784 2968 rundll32.exe rundll32.exe PID 2968 wrote to memory of 2784 2968 rundll32.exe rundll32.exe PID 2784 wrote to memory of 2676 2784 rundll32.exe WerFault.exe PID 2784 wrote to memory of 2676 2784 rundll32.exe WerFault.exe PID 2784 wrote to memory of 2676 2784 rundll32.exe WerFault.exe PID 2784 wrote to memory of 2676 2784 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\inf2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\inf2.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 2243⤵
- Program crash