Resubmissions
27-11-2023 06:49
231127-hlvpcseh82 327-11-2023 06:47
231127-hkm8wseg81 321-11-2023 16:06
231121-tkjfgsfe62 321-11-2023 16:06
231121-tj267sgc2z 321-11-2023 10:08
231121-l571ksdg28 3Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2023 10:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
inf2.dll
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
inf2.dll
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
inf2.dll
-
Size
1.1MB
-
MD5
491de488716811cf6c432a435a413688
-
SHA1
469567c2bf172c4e0d270b085ae9acaf0559c066
-
SHA256
eead7f5b6f1282ad988238cc8c39292fa99ea416f7793038a20e5caabe93112a
-
SHA512
b7957da02eefa228900bbe1f3c1a5080c142be8d4311c748e921241ade7e4f3ae975d654464939d705a96d0bdcd7e94974fdb74ecc44b1a283c0ea47c894bb24
-
SSDEEP
24576:j0LPo6+J+dxYv7IQF8Z+nZlFlMfNpRYKrHabx6SqoUTb5dXGredODkYgn4iD0:Oo6+J+dxYv7II8bExk3XGredOR1iY
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3420 32 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3036 wrote to memory of 32 3036 rundll32.exe rundll32.exe PID 3036 wrote to memory of 32 3036 rundll32.exe rundll32.exe PID 3036 wrote to memory of 32 3036 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\inf2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\inf2.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 32 -ip 321⤵