Analysis
-
max time kernel
135s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
21-06-2024 18:32
Static task
static1
Behavioral task
behavioral1
Sample
$RAGT9PA.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/inetc.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win10-20240404-en
General
-
Target
$PLUGINSDIR/inetc.dll
-
Size
38KB
-
MD5
a35cdc9cf1d17216c0ab8c5282488ead
-
SHA1
ed8e8091a924343ad8791d85e2733c14839f0d36
-
SHA256
a793929232afb78b1c5b2f45d82094098bcf01523159fad1032147d8d5f9c4df
-
SHA512
0f15b00d0bf2aabd194302e599d69962147b4b3ef99e5a5f8d5797a7a56fd75dd9db0a667cfba9c758e6f0dab9ced126a9b43948935fe37fc31d96278a842bdf
-
SSDEEP
384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2724 4644 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4144 wrote to memory of 4644 4144 rundll32.exe rundll32.exe PID 4144 wrote to memory of 4644 4144 rundll32.exe rundll32.exe PID 4144 wrote to memory of 4644 4144 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#12⤵PID:4644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 6283⤵
- Program crash
PID:2724
-
-