Analysis
-
max time kernel
109s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 14:21
Static task
static1
Behavioral task
behavioral1
Sample
4754b4655a3f26c578e35710643f7200N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4754b4655a3f26c578e35710643f7200N.dll
Resource
win10v2004-20240802-en
General
-
Target
4754b4655a3f26c578e35710643f7200N.dll
-
Size
7KB
-
MD5
4754b4655a3f26c578e35710643f7200
-
SHA1
02e818d168b1be6de66f9195f5feee406f9877ae
-
SHA256
22d1c30afab13149fefeb4fc6e712fb86b7a0bddd960960e70ad2d54be7c59e7
-
SHA512
d759379a1ceae02bedfdf9db9456628e725861787ff3197158efd878b3e783c8518e40d3ed03234a99ef2a423dd0754c704ec98e39baf9087c9809a0fae0590b
-
SSDEEP
192:unSR6bgYzfl1o5TbFQa11111111iv69HWHGHVHA:uZytaqV
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4772 wrote to memory of 2832 4772 rundll32.exe 84 PID 4772 wrote to memory of 2832 4772 rundll32.exe 84 PID 4772 wrote to memory of 2832 4772 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4754b4655a3f26c578e35710643f7200N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4754b4655a3f26c578e35710643f7200N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2832
-