Overview
overview
10Static
static
362548c66d1...6a.exe
windows7-x64
1062548c66d1...6a.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3MonitorPlugin.dll
windows7-x64
1MonitorPlugin.dll
windows10-2004-x64
1Skriveblok...-1.dll
windows7-x64
1Skriveblok...-1.dll
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 12:53
Static task
static1
Behavioral task
behavioral1
Sample
62548c66d11776c84706553bdd76afd7248d2c3e69b0f47215c0dc307f0dd06a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
62548c66d11776c84706553bdd76afd7248d2c3e69b0f47215c0dc307f0dd06a.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
MonitorPlugin.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
MonitorPlugin.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
Skriveblokkes/libdatrie-1.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Skriveblokkes/libdatrie-1.dll
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
2ae993a2ffec0c137eb51c8832691bcb
-
SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1
-
SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
-
SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
SSDEEP
192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3628 2220 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4728 wrote to memory of 2220 4728 rundll32.exe rundll32.exe PID 4728 wrote to memory of 2220 4728 rundll32.exe rundll32.exe PID 4728 wrote to memory of 2220 4728 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵PID:2220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 6123⤵
- Program crash
PID:3628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2220 -ip 22201⤵PID:4924