Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
03-08-2024 17:43
Static task
static1
Behavioral task
behavioral1
Sample
iplasetup.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
$TEMP.dll
Resource
win10-20240404-en
General
-
Target
$TEMP.dll
-
Size
5KB
-
MD5
db40175690a780def9e6c6327654be11
-
SHA1
703c074a625fad245300fb97657f640e91ce36d6
-
SHA256
08a4ab71158afdaea82ae1f5670ae87b0b03facd606db26d4861c178b630cec2
-
SHA512
17012e166365a48a7dcc92aa9f4d67e6fafa347eb637f434d99a4f0f62fd6a438eb21e98aff18f04cc56e3d91e97022a2bf4ef35278d9d15146dbeab6d3c5c7a
-
SSDEEP
96:FnGNpgIYetuYR/8oJ00/NF73XK9FoyC7tCElY:FGNpueUY91JnP6
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2900 4164 WerFault.exe 73 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4604 wrote to memory of 4164 4604 rundll32.exe 73 PID 4604 wrote to memory of 4164 4604 rundll32.exe 73 PID 4604 wrote to memory of 4164 4604 rundll32.exe 73
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP.dll,#12⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:4164 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 6163⤵
- Program crash
PID:2900
-
-