Analysis
-
max time kernel
105s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 13:25
Static task
static1
Behavioral task
behavioral1
Sample
866ef813e295dceed59a001ef4f50fd0N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
866ef813e295dceed59a001ef4f50fd0N.dll
Resource
win10v2004-20240802-en
General
-
Target
866ef813e295dceed59a001ef4f50fd0N.dll
-
Size
6KB
-
MD5
866ef813e295dceed59a001ef4f50fd0
-
SHA1
288954dace09f12adf989e9a4468a0b0d7167986
-
SHA256
fb163ab14315ca9e4ccc40e3d9be06560da061c3e0d15f47a027e9a5feaa4ace
-
SHA512
e12b8a4deae8bc2f3f71e111fcc1b9e0f921fd7837c5bbc32b4d40d22a1af6d42fb6dbda11ecbf70118abe48b00848e502fefbdd5bf0986d0845e25d6518e6f2
-
SSDEEP
48:6WQV5YVOqtV0H1pw9ygYVUG0RB+BDq9J5SC:8qtV0HAr4YB+FqX5SC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3400 wrote to memory of 4436 3400 rundll32.exe 84 PID 3400 wrote to memory of 4436 3400 rundll32.exe 84 PID 3400 wrote to memory of 4436 3400 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\866ef813e295dceed59a001ef4f50fd0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\866ef813e295dceed59a001ef4f50fd0N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4436
-