Overview
overview
10Static
static
331318ee805...3f.exe
windows7-x64
1031318ee805...3f.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3403-3.htm
windows7-x64
1403-3.htm
windows10-2004-x64
1HelpButton.dll
windows7-x64
3HelpButton.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 02:30
Static task
static1
Behavioral task
behavioral1
Sample
31318ee80570c7168708575f032ac63f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
31318ee80570c7168708575f032ac63f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
403-3.htm
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
403-3.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
HelpButton.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
HelpButton.dll
Resource
win10v2004-20240426-en
General
-
Target
HelpButton.dll
-
Size
68KB
-
MD5
27a5e7b6a25949beeae9d66ee66759b4
-
SHA1
c98d27eb5421cc0e12f1736d8cb6da952df25635
-
SHA256
ca1469a748c0805bedaa6bbcf87cfea1772a004ce5fb1ef1e5f62998874d4851
-
SHA512
426dd583044d651b790e006189d2ff42dcb883851dffa61cef2b4badaa43fde5a718e8ec4415ac928a39b81a6507ab54d2a1d0842bfbec4db89656478b610bea
-
SSDEEP
1536:8ozXAk1PgqYVWGzu4MOCucLcvqlURlwxvGf:8ozXAkeZxQYRlwxvG
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1936 1260 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1924 wrote to memory of 1260 1924 rundll32.exe rundll32.exe PID 1924 wrote to memory of 1260 1924 rundll32.exe rundll32.exe PID 1924 wrote to memory of 1260 1924 rundll32.exe rundll32.exe PID 1924 wrote to memory of 1260 1924 rundll32.exe rundll32.exe PID 1924 wrote to memory of 1260 1924 rundll32.exe rundll32.exe PID 1924 wrote to memory of 1260 1924 rundll32.exe rundll32.exe PID 1924 wrote to memory of 1260 1924 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1936 1260 rundll32.exe WerFault.exe PID 1260 wrote to memory of 1936 1260 rundll32.exe WerFault.exe PID 1260 wrote to memory of 1936 1260 rundll32.exe WerFault.exe PID 1260 wrote to memory of 1936 1260 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\HelpButton.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\HelpButton.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 2603⤵
- Program crash