Analysis

  • max time kernel
    91s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-08-2024 12:14

General

  • Target

    Microsoft DirectX/dxupdate.dll

  • Size

    173KB

  • MD5

    a2a0da126c1a2f8b615b363e862989a2

  • SHA1

    7716675d561b939f8bd22306d05e9671c7da0014

  • SHA256

    300abf15fc1b38373053b898ad9a57098fa5656f26325f45b3d644befa74d428

  • SHA512

    4b428749e2f207a2d7f3ccc5fc6c53a07a17f8f7b6055596531e0e71f4f2932494fe9f751e4251fb559931a91379f2f0504ac218f3c77127434d4abb9e869c73

  • SSDEEP

    3072:xp6LK2/wRi/9S7BLpKG/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTH6KaY:ywRaI3rfuFVeNgosUBxra4rIZsqq

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Microsoft DirectX\dxupdate.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Microsoft DirectX\dxupdate.dll",#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 636
        3⤵
        • Program crash
        PID:3532
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2576 -ip 2576
    1⤵
      PID:3456

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads