Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 16:42
Static task
static1
Behavioral task
behavioral1
Sample
documents 53 ACH 775-53 ABM 912.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
documents 53 ACH 775-53 ABM 912.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
17ed1c86bd67e78ade4712be48a7d2bd
-
SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
-
SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
-
SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
SSDEEP
192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2316 2508 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2384 wrote to memory of 2508 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 2508 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 2508 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 2508 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 2508 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 2508 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 2508 2384 rundll32.exe rundll32.exe PID 2508 wrote to memory of 2316 2508 rundll32.exe WerFault.exe PID 2508 wrote to memory of 2316 2508 rundll32.exe WerFault.exe PID 2508 wrote to memory of 2316 2508 rundll32.exe WerFault.exe PID 2508 wrote to memory of 2316 2508 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 2283⤵
- Program crash