Overview
overview
7Static
static
3f_003780.exe
windows11-21h2-x64
7$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...on.dll
windows11-21h2-x64
3$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...nz.dll
windows11-21h2-x64
3$TEMP/unin...fc.exe
windows11-21h2-x64
7Analysis
-
max time kernel
207s -
max time network
296s -
platform
windows11-21h2_x64 -
resource
win11-20231222-en -
resource tags
arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/01/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
f_003780.exe
Resource
win11-20231215-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win11-20231222-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win11-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win11-20231222-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20231215-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win11-20231215-en
Behavioral task
behavioral8
Sample
$TEMP/uninstall_fc.exe
Resource
win11-20231215-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
c17103ae9072a06da581dec998343fc1
-
SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
-
SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
-
SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
SSDEEP
192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1332 2552 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1440 wrote to memory of 2552 1440 rundll32.exe 79 PID 1440 wrote to memory of 2552 1440 rundll32.exe 79 PID 1440 wrote to memory of 2552 1440 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵PID:2552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 4603⤵
- Program crash
PID:1332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2552 -ip 25521⤵PID:4408