Overview
overview
10Static
static
3750c447d6e...9c.exe
windows7-x64
10750c447d6e...9c.exe
windows10-2004-x64
10AudioManag...le.exe
windows7-x64
10AudioManag...le.exe
windows10-2004-x64
10Microsoft....ns.dll
windows7-x64
1Microsoft....ns.dll
windows10-2004-x64
1PocoInitializer.dll
windows7-x64
1PocoInitializer.dll
windows10-2004-x64
1System.Win...ty.dll
windows7-x64
1System.Win...ty.dll
windows10-2004-x64
1bass.dll
windows7-x64
1bass.dll
windows10-2004-x64
1bzip2.dll
windows7-x64
3bzip2.dll
windows10-2004-x64
3d3d10core.dll
windows10-2004-x64
1iconv.dll
windows7-x64
3iconv.dll
windows10-2004-x64
3libgthread-2.0-0.dll
windows7-x64
1libgthread-2.0-0.dll
windows10-2004-x64
1wxwidgetsforms2.dll
windows7-x64
10wxwidgetsforms2.dll
windows10-2004-x64
10xmlparse.dll
windows7-x64
1xmlparse.dll
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 11:54
Static task
static1
Behavioral task
behavioral1
Sample
750c447d6e3c7d74ccab736a0082ef437b1cd2000d761d3aff2b73227457b29c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
750c447d6e3c7d74ccab736a0082ef437b1cd2000d761d3aff2b73227457b29c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
AudioManagementConsole.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
AudioManagementConsole.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Microsoft.Expression.Interactions.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
Microsoft.Expression.Interactions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
PocoInitializer.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
PocoInitializer.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral9
Sample
System.Windows.Interactivity.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
System.Windows.Interactivity.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
bass.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
bass.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
bzip2.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
bzip2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
d3d10core.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral16
Sample
iconv.dll
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
iconv.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
libgthread-2.0-0.dll
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
libgthread-2.0-0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
wxwidgetsforms2.dll
Resource
win7-20240319-en
Behavioral task
behavioral21
Sample
wxwidgetsforms2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
xmlparse.dll
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
xmlparse.dll
Resource
win10v2004-20240226-en
General
-
Target
iconv.dll
-
Size
32KB
-
MD5
e1349d5e1238889819906f3e1fbe3b65
-
SHA1
4099bbef8128ab2ce15767c2028169d89a69724e
-
SHA256
f33efe8112f644383c0852e2232117f7b492264d74664bf70357666538c0b41d
-
SHA512
5c725d32d17f7478a698e7b59e107e2ae0dd90ac1eccbf21cefacaa632d463149d9f221779ef01459c17bb3b4c2ea7eeaecf1b5ac251e961a4c9fed399cf6960
-
SSDEEP
768:+4Hnnn9k2VhvWgUtAAfTspDHbMdiR2+Ga:+497V5UtDTsppY+Ga
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4956 516 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1928 wrote to memory of 516 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 516 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 516 1928 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\iconv.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\iconv.dll,#12⤵PID:516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 6003⤵
- Program crash
PID:4956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 516 -ip 5161⤵PID:5100