Analysis
-
max time kernel
108s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2024, 01:17
Behavioral task
behavioral1
Sample
2c28c2c86016821ecd68de8125708730N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2c28c2c86016821ecd68de8125708730N.dll
Resource
win10v2004-20240709-en
General
-
Target
2c28c2c86016821ecd68de8125708730N.dll
-
Size
76KB
-
MD5
2c28c2c86016821ecd68de8125708730
-
SHA1
3a258fc175cd58526c1708df8a32021f64e1d375
-
SHA256
d04c123d1ddc6d2d7e7a8cb3e60c3aca1fdf0e1a2ed54414a8cbf0be045b119a
-
SHA512
e647b6eaf876a770404b2ea0671ff3f627863090ac8d89e43d5edf06c3bac043ffff6a6f13cec4977451556924debb4a611d3c7e2213de53b40de9806f42578a
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z4I/2K8n:c8y93KQjy7G55riF1cMo03K4En
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
resource yara_rule behavioral2/memory/4448-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4448-1-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4448-2-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3580 4448 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4448 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4372 wrote to memory of 4448 4372 rundll32.exe 83 PID 4372 wrote to memory of 4448 4372 rundll32.exe 83 PID 4372 wrote to memory of 4448 4372 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c28c2c86016821ecd68de8125708730N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c28c2c86016821ecd68de8125708730N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 7043⤵
- Program crash
PID:3580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4448 -ip 44481⤵PID:1988