Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 01:21
Static task
static1
Behavioral task
behavioral1
Sample
82e229a2ad5bb0b83ce6dd994792922fa36636a303852237dfa2213daf97111f.dll
Resource
win7-20240704-en
General
-
Target
82e229a2ad5bb0b83ce6dd994792922fa36636a303852237dfa2213daf97111f.dll
-
Size
1.1MB
-
MD5
4ff8593a6591e4dbb100c30e0b658235
-
SHA1
376a81ee7818f2738609183ba20a8daeb146c903
-
SHA256
82e229a2ad5bb0b83ce6dd994792922fa36636a303852237dfa2213daf97111f
-
SHA512
cc005ea9e828763df05cff169c8146e3b5467d68c1043472d415008b12849ba64141e2d888c85eb4e433ba6cdd07b1f767baf74a72bbf9f9e765b13b2dcb796e
-
SSDEEP
6144:jDgtfRQUHPw06MoV2nwTBlhm8zDgtfRQUHPw06MoV2nwTBlhm8J:jDgN6MoIwT3vDgN6MoIwT31
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1952 wrote to memory of 1276 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1276 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1276 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1276 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1276 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1276 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1276 1952 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\82e229a2ad5bb0b83ce6dd994792922fa36636a303852237dfa2213daf97111f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\82e229a2ad5bb0b83ce6dd994792922fa36636a303852237dfa2213daf97111f.dll,#12⤵
- System Location Discovery: System Language Discovery