Analysis
-
max time kernel
86s -
max time network
88s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 09:04
Static task
static1
Behavioral task
behavioral1
Sample
b25ebcd7039b52256f0f5e74671bd5c0N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b25ebcd7039b52256f0f5e74671bd5c0N.dll
Resource
win10v2004-20240709-en
General
-
Target
b25ebcd7039b52256f0f5e74671bd5c0N.dll
-
Size
369KB
-
MD5
b25ebcd7039b52256f0f5e74671bd5c0
-
SHA1
cab66643ef5b156e51fc08cbaec48314b61fcdd5
-
SHA256
6a0ce36d69d538854f93c608ff2ed641d9f08b3824eb370fe39ffdd5820e8c72
-
SHA512
3b2608b8bbe3fe4964328e409a9140b3fbddad43ab009b5f582b143d77d702880f039faf159f3a5b3b0efda7896466c3b19b664ec3c6c4c815c619c9b4a53f77
-
SSDEEP
6144:tSx+OgVWGt0PAwMddhT9L/YwIVPMokEClh6J4/mShoFaq5wI2vYG6lS11l:t0geA/HwwmPXkEohBOShaaq6vYGAS1f
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4700 396 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4452 wrote to memory of 396 4452 rundll32.exe 84 PID 4452 wrote to memory of 396 4452 rundll32.exe 84 PID 4452 wrote to memory of 396 4452 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b25ebcd7039b52256f0f5e74671bd5c0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b25ebcd7039b52256f0f5e74671bd5c0N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 7523⤵
- Program crash
PID:4700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 396 -ip 3961⤵PID:4868