Analysis
-
max time kernel
134s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 12:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ktpassword.dll
Resource
win7-20240220-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ktpassword.dll
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
ktpassword.dll
-
Size
142KB
-
MD5
3587b4016d43b08bbb9f2c10056d2f55
-
SHA1
cb0e9cd4894195c4baeec7d1a1be570c4b6734f3
-
SHA256
411d61a49c8a82e0091b7fa68782f62318d374c7b7e8689ce59a35bbf27d7d74
-
SHA512
c7fcb63de6d5765f58a788547218a12a9a825aa6f97c0a542f3c50a8d43d3aed68dbdfce2234cc30f02291c6af942e1c0a17a49fc16bfc69d876ba4418c303b1
-
SSDEEP
3072:1gzmTFeacfFcF8y4uu1dtpij80HGG+q9OzAZhY:1gzmTFePfFcCuu1YHf+q9Oz9
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3228 2856 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2856 2912 rundll32.exe 82 PID 2912 wrote to memory of 2856 2912 rundll32.exe 82 PID 2912 wrote to memory of 2856 2912 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ktpassword.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ktpassword.dll,#12⤵PID:2856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 6043⤵
- Program crash
PID:3228
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2856 -ip 28561⤵PID:4500