Resubmissions
27-11-2023 06:49
231127-hlvpcseh82 327-11-2023 06:47
231127-hkm8wseg81 321-11-2023 16:06
231121-tkjfgsfe62 321-11-2023 16:06
231121-tj267sgc2z 321-11-2023 10:08
231121-l571ksdg28 3Analysis
-
max time kernel
33s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2023 06:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
inf2.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
60 seconds
General
-
Target
inf2.dll
-
Size
1.1MB
-
MD5
491de488716811cf6c432a435a413688
-
SHA1
469567c2bf172c4e0d270b085ae9acaf0559c066
-
SHA256
eead7f5b6f1282ad988238cc8c39292fa99ea416f7793038a20e5caabe93112a
-
SHA512
b7957da02eefa228900bbe1f3c1a5080c142be8d4311c748e921241ade7e4f3ae975d654464939d705a96d0bdcd7e94974fdb74ecc44b1a283c0ea47c894bb24
-
SSDEEP
24576:j0LPo6+J+dxYv7IQF8Z+nZlFlMfNpRYKrHabx6SqoUTb5dXGredODkYgn4iD0:Oo6+J+dxYv7II8bExk3XGredOR1iY
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1160 1316 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
rundll32.execmd.exedescription pid process target process PID 4832 wrote to memory of 1316 4832 rundll32.exe rundll32.exe PID 4832 wrote to memory of 1316 4832 rundll32.exe rundll32.exe PID 4832 wrote to memory of 1316 4832 rundll32.exe rundll32.exe PID 4312 wrote to memory of 3984 4312 cmd.exe rundll32.exe PID 4312 wrote to memory of 3984 4312 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\inf2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\inf2.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1316 -ip 13161⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe inf2.dll Limit2⤵