Overview
overview
3Static
static
3freebl3.dll
windows7-x64
1freebl3.dll
windows10-2004-x64
1freebl3.dll
windows11-21h2-x64
1mozglue.dll
windows7-x64
3mozglue.dll
windows10-2004-x64
3mozglue.dll
windows11-21h2-x64
3msvcp140.dll
windows7-x64
3msvcp140.dll
windows10-2004-x64
3msvcp140.dll
windows11-21h2-x64
3nss3.dll
windows7-x64
1nss3.dll
windows10-2004-x64
3nss3.dll
windows11-21h2-x64
3softokn3.dll
windows7-x64
3softokn3.dll
windows10-2004-x64
3softokn3.dll
windows11-21h2-x64
3sqlite3.dll
windows7-x64
3sqlite3.dll
windows10-2004-x64
3sqlite3.dll
windows11-21h2-x64
3vcruntime140.dll
windows7-x64
3vcruntime140.dll
windows10-2004-x64
3vcruntime140.dll
windows11-21h2-x64
3Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 11:59
Static task
static1
Behavioral task
behavioral1
Sample
freebl3.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
freebl3.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
freebl3.dll
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
mozglue.dll
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
mozglue.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
mozglue.dll
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
msvcp140.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
msvcp140.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
msvcp140.dll
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
nss3.dll
Resource
win7-20240705-en
Behavioral task
behavioral11
Sample
nss3.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
nss3.dll
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
softokn3.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
softokn3.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
softokn3.dll
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
sqlite3.dll
Resource
win7-20240704-en
Behavioral task
behavioral17
Sample
sqlite3.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
sqlite3.dll
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
vcruntime140.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
vcruntime140.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
vcruntime140.dll
Resource
win11-20240709-en
General
-
Target
vcruntime140.dll
-
Size
78KB
-
MD5
a37ee36b536409056a86f50e67777dd7
-
SHA1
1cafa159292aa736fc595fc04e16325b27cd6750
-
SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
-
SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
SSDEEP
1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1424 772 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1580 wrote to memory of 772 1580 rundll32.exe 30 PID 1580 wrote to memory of 772 1580 rundll32.exe 30 PID 1580 wrote to memory of 772 1580 rundll32.exe 30 PID 1580 wrote to memory of 772 1580 rundll32.exe 30 PID 1580 wrote to memory of 772 1580 rundll32.exe 30 PID 1580 wrote to memory of 772 1580 rundll32.exe 30 PID 1580 wrote to memory of 772 1580 rundll32.exe 30 PID 772 wrote to memory of 1424 772 rundll32.exe 31 PID 772 wrote to memory of 1424 772 rundll32.exe 31 PID 772 wrote to memory of 1424 772 rundll32.exe 31 PID 772 wrote to memory of 1424 772 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 2203⤵
- Program crash
PID:1424
-
-