Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-01-2024 09:09
Static task
static1
Behavioral task
behavioral1
Sample
TempData30268010203/Galaxy.DVI.03504.8815.255.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
TempData30268010203/Galaxy.DVI.03504.8815.255.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
TempData30268010203/sqlite3.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
TempData30268010203/sqlite3.dll
Resource
win10v2004-20231215-en
General
-
Target
TempData30268010203/sqlite3.dll
-
Size
910KB
-
MD5
def2572ccae7f518bd9d30f37b2fed04
-
SHA1
eaec1754a69c50eac99e774b07ef156a1ca6de06
-
SHA256
b712286d4d36c74fa32127f848b79cfb857fdc2b1c84bbbee285cf34752443a2
-
SHA512
f6183e6b7989cfc342f28074e0c79223765a5995e04e5e1e9d2c6edd12837bf5a825a0800f2941c3c7eedc37258052fd72fd7f1421d88c426666a30b4436aa4a
-
SSDEEP
24576:eYFrkZwGN1oSBMMBuNOh7pRUTM+Eex/3Di:eM6MSBlB2Oh7pRUort
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1668 1216 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2216 wrote to memory of 1216 2216 rundll32.exe rundll32.exe PID 2216 wrote to memory of 1216 2216 rundll32.exe rundll32.exe PID 2216 wrote to memory of 1216 2216 rundll32.exe rundll32.exe PID 2216 wrote to memory of 1216 2216 rundll32.exe rundll32.exe PID 2216 wrote to memory of 1216 2216 rundll32.exe rundll32.exe PID 2216 wrote to memory of 1216 2216 rundll32.exe rundll32.exe PID 2216 wrote to memory of 1216 2216 rundll32.exe rundll32.exe PID 1216 wrote to memory of 1668 1216 rundll32.exe WerFault.exe PID 1216 wrote to memory of 1668 1216 rundll32.exe WerFault.exe PID 1216 wrote to memory of 1668 1216 rundll32.exe WerFault.exe PID 1216 wrote to memory of 1668 1216 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TempData30268010203\sqlite3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TempData30268010203\sqlite3.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 2243⤵
- Program crash
PID:1668