Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15-01-2024 08:22
Static task
static1
Behavioral task
behavioral1
Sample
PYMT SOA SUCCESSFUL AVIS CREDIT 15012024.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
PYMT SOA SUCCESSFUL AVIS CREDIT 15012024.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
17ed1c86bd67e78ade4712be48a7d2bd
-
SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
-
SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
-
SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
SSDEEP
192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2968 2952 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2884 wrote to memory of 2952 2884 rundll32.exe rundll32.exe PID 2884 wrote to memory of 2952 2884 rundll32.exe rundll32.exe PID 2884 wrote to memory of 2952 2884 rundll32.exe rundll32.exe PID 2884 wrote to memory of 2952 2884 rundll32.exe rundll32.exe PID 2884 wrote to memory of 2952 2884 rundll32.exe rundll32.exe PID 2884 wrote to memory of 2952 2884 rundll32.exe rundll32.exe PID 2884 wrote to memory of 2952 2884 rundll32.exe rundll32.exe PID 2952 wrote to memory of 2968 2952 rundll32.exe WerFault.exe PID 2952 wrote to memory of 2968 2952 rundll32.exe WerFault.exe PID 2952 wrote to memory of 2968 2952 rundll32.exe WerFault.exe PID 2952 wrote to memory of 2968 2952 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 2243⤵
- Program crash
PID:2968