Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
32439b3820900862e1793bbaea4c0445a60225ce6f9f40d920ac91cc8d1860e7.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
32439b3820900862e1793bbaea4c0445a60225ce6f9f40d920ac91cc8d1860e7.dll
Resource
win10v2004-20231215-en
General
-
Target
32439b3820900862e1793bbaea4c0445a60225ce6f9f40d920ac91cc8d1860e7.dll
-
Size
397KB
-
MD5
9ef2acaa41da128934a81df0dd4ddb09
-
SHA1
b8f02e47a15204e623eb66ed1175c52a187d3aa8
-
SHA256
32439b3820900862e1793bbaea4c0445a60225ce6f9f40d920ac91cc8d1860e7
-
SHA512
94fc1561804744dfc2d29bbc9129ace543309e83b10be69b8b06effa9f6700d8a94fad3406709ab6138efc41dd9dac77ef341c17842e9ac0f823daf7dab344aa
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaL:174g2LDeiPDImOkx2LIaL
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1708 2128 WerFault.exe 88 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2128 rundll32.exe Token: SeTcbPrivilege 2128 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1148 wrote to memory of 2128 1148 rundll32.exe 88 PID 1148 wrote to memory of 2128 1148 rundll32.exe 88 PID 1148 wrote to memory of 2128 1148 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32439b3820900862e1793bbaea4c0445a60225ce6f9f40d920ac91cc8d1860e7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32439b3820900862e1793bbaea4c0445a60225ce6f9f40d920ac91cc8d1860e7.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 7123⤵
- Program crash
PID:1708
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2128 -ip 21281⤵PID:4900