Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 12:55
Static task
static1
Behavioral task
behavioral1
Sample
Borgerreprsentants.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Borgerreprsentants.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
b8992e497d57001ddf100f9c397fcef5
-
SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd
-
SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b
-
SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c
-
SSDEEP
192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3064 2972 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2956 wrote to memory of 2972 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2972 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2972 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2972 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2972 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2972 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2972 2956 rundll32.exe rundll32.exe PID 2972 wrote to memory of 3064 2972 rundll32.exe WerFault.exe PID 2972 wrote to memory of 3064 2972 rundll32.exe WerFault.exe PID 2972 wrote to memory of 3064 2972 rundll32.exe WerFault.exe PID 2972 wrote to memory of 3064 2972 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 2243⤵
- Program crash
PID:3064