Analysis
-
max time kernel
110s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 01:17
Behavioral task
behavioral1
Sample
2c28c2c86016821ecd68de8125708730N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2c28c2c86016821ecd68de8125708730N.dll
Resource
win10v2004-20240709-en
General
-
Target
2c28c2c86016821ecd68de8125708730N.dll
-
Size
76KB
-
MD5
2c28c2c86016821ecd68de8125708730
-
SHA1
3a258fc175cd58526c1708df8a32021f64e1d375
-
SHA256
d04c123d1ddc6d2d7e7a8cb3e60c3aca1fdf0e1a2ed54414a8cbf0be045b119a
-
SHA512
e647b6eaf876a770404b2ea0671ff3f627863090ac8d89e43d5edf06c3bac043ffff6a6f13cec4977451556924debb4a611d3c7e2213de53b40de9806f42578a
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z4I/2K8n:c8y93KQjy7G55riF1cMo03K4En
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3032-1-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3032-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3032-2-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3032-3-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3068 3032 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3032 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1356 wrote to memory of 3032 1356 rundll32.exe 30 PID 1356 wrote to memory of 3032 1356 rundll32.exe 30 PID 1356 wrote to memory of 3032 1356 rundll32.exe 30 PID 1356 wrote to memory of 3032 1356 rundll32.exe 30 PID 1356 wrote to memory of 3032 1356 rundll32.exe 30 PID 1356 wrote to memory of 3032 1356 rundll32.exe 30 PID 1356 wrote to memory of 3032 1356 rundll32.exe 30 PID 3032 wrote to memory of 3068 3032 rundll32.exe 31 PID 3032 wrote to memory of 3068 3032 rundll32.exe 31 PID 3032 wrote to memory of 3068 3032 rundll32.exe 31 PID 3032 wrote to memory of 3068 3032 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c28c2c86016821ecd68de8125708730N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c28c2c86016821ecd68de8125708730N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 3123⤵
- Program crash
PID:3068
-
-