Analysis
-
max time kernel
90s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-05-2024 19:22
Static task
static1
Behavioral task
behavioral1
Sample
fldigi-4.2.05_setup.exe
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
flarq.exe
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
fldigi.exe
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
uninstall.exe
Resource
win11-20240426-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
29KB
-
MD5
26c8a92678f1b970ac2a700bb844c309
-
SHA1
c821a5980c31b0b35f1505cde836d6769f45e3a3
-
SHA256
2a7b5d1cab96a5280b0694d0ed54510129626a1ba36a51bd34d546972b7d18b8
-
SHA512
fba6e371853fd6c27097eb7cce7ffc59d71e4f0a9b5e55de06472d094b70c44a409bd82f39d9a27a814e826ab8468c59e947401a3c3ead1f057cbac236588860
-
SSDEEP
384:icchls/EvE2XYBVtQQA+S4n+7g6ZxlU7RfYkvIZMIwwH3Y9pyWediASIo:dmHckOVih+S/Fxq7v4H3YCoASIo
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2244 4344 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4340 wrote to memory of 4344 4340 rundll32.exe rundll32.exe PID 4340 wrote to memory of 4344 4340 rundll32.exe rundll32.exe PID 4340 wrote to memory of 4344 4340 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵PID:4344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 4603⤵
- Program crash
PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4344 -ip 43441⤵PID:760
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4344-0-0x0000000075440000-0x000000007544F000-memory.dmpFilesize
60KB