Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 06:28

General

  • Target

    $SYSDIR/InterPass2000P11.dll

  • Size

    892KB

  • MD5

    809f63601ef78a3cbcbdfab1f4816f73

  • SHA1

    6122e2108502b7e52c8a07e8953daf2dfd54c6dd

  • SHA256

    806b77200f87f245a39da02bb7548654ce11cf7ebbbc123c72a93f93c74ca7f0

  • SHA512

    6496887b99a271c06d6bc59b54c99e3fe6108bed199d86c07b5b3945dcd362a396a925a9579f8fe16239a3d794347504d63f031d51d70624e06021bcad3b1434

  • SSDEEP

    24576:5Z5Sl7ZaOE7tiGJhDlqAony9OK+TdLO4og8CDtjYM42q4S:fA0QdLOQ8O5x42q4S

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\InterPass2000P11.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\InterPass2000P11.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads