Analysis

  • max time kernel
    117s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    28-07-2024 22:51

General

  • Target

    $PLUGINSDIR/Plugin.dll

  • Size

    2.1MB

  • MD5

    67ad13de4800015f22cffaa96e1cdd41

  • SHA1

    542fb5baeea3f3b7ebdc70061790612ae9bfd0dc

  • SHA256

    ea847b3e559321f8825d4339ad503b8082546ad7f9ae1d8373914f2ffaf3e6a2

  • SHA512

    c2f776d6b4091dcc241ca25d3d1134f7487f6ffd1e58b6108d3dae655cdb949c3ded8a03a952ec33947c61cb0213fde25b79992ca86327e380f30140a881a79b

  • SSDEEP

    49152:sLiFc4XSrTu9TCEl/EswofHbTdTqTDvqPe:IiFc4XSrOHE8fHPe

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Plugin.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Plugin.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 256
        3⤵
        • Program crash
        PID:2428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads