Overview
overview
7Static
static
3dc02961c31...0d.exe
windows7-x64
7dc02961c31...0d.exe
windows10-2004-x64
7$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$R1.dll
windows7-x64
6$R1.dll
windows10-2004-x64
6Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 15:49
Static task
static1
Behavioral task
behavioral1
Sample
dc02961c3109e7369f377da2913ba80d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dc02961c3109e7369f377da2913ba80d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$R1.dll
Resource
win7-20240319-en
General
-
Target
$PLUGINSDIR/Math.dll
-
Size
66KB
-
MD5
8835b67f15d96144f3184e684fa76b43
-
SHA1
365e34a34eb8c123d765b7deefd3ebb90fe0fe4b
-
SHA256
df1e70965e0aab1b464e623ccaee5457e66dc2e955733658c8fc337a893aa51c
-
SHA512
3a7f89af391708c56d1d117e24f2f9f1c5e3db27716665fcfed66aea64d2a72ac293cb3b8d09482438b06f5e1f97338fd700d0ccef036814047b0842ad8b9c13
-
SSDEEP
1536:NPyr/G6SdHg4amq2MwtmIuqFVxL9NvIml/o:N6AHg6bH5lQ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2672 2880 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2880 2236 rundll32.exe 28 PID 2236 wrote to memory of 2880 2236 rundll32.exe 28 PID 2236 wrote to memory of 2880 2236 rundll32.exe 28 PID 2236 wrote to memory of 2880 2236 rundll32.exe 28 PID 2236 wrote to memory of 2880 2236 rundll32.exe 28 PID 2236 wrote to memory of 2880 2236 rundll32.exe 28 PID 2236 wrote to memory of 2880 2236 rundll32.exe 28 PID 2880 wrote to memory of 2672 2880 rundll32.exe 29 PID 2880 wrote to memory of 2672 2880 rundll32.exe 29 PID 2880 wrote to memory of 2672 2880 rundll32.exe 29 PID 2880 wrote to memory of 2672 2880 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Math.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Math.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 2243⤵
- Program crash
PID:2672
-
-