Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 22:35
Static task
static1
Behavioral task
behavioral1
Sample
999007bbeba00112e56503ad03a9e720N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
999007bbeba00112e56503ad03a9e720N.dll
Resource
win10v2004-20240802-en
General
-
Target
999007bbeba00112e56503ad03a9e720N.dll
-
Size
7KB
-
MD5
999007bbeba00112e56503ad03a9e720
-
SHA1
3d0971d2946b09055840d76d9652bab635771fe5
-
SHA256
9b5756c717551582e626f0d3895bbd4fffaf9f5b822c380c5f12431798aff441
-
SHA512
4c8f771d89898bdf6eeea0764af7fed83078b5a9ab26f0e2faa081b1956cc1d28ae91d7793f20944de6614c748d6744e4af15159bff821ae883835d071f29631
-
SSDEEP
48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWObABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPMq3qX5S2hV
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1348 2408 rundll32.exe 28 PID 2408 wrote to memory of 1348 2408 rundll32.exe 28 PID 2408 wrote to memory of 1348 2408 rundll32.exe 28 PID 2408 wrote to memory of 1348 2408 rundll32.exe 28 PID 2408 wrote to memory of 1348 2408 rundll32.exe 28 PID 2408 wrote to memory of 1348 2408 rundll32.exe 28 PID 2408 wrote to memory of 1348 2408 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\999007bbeba00112e56503ad03a9e720N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\999007bbeba00112e56503ad03a9e720N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1348
-