Analysis

  • max time kernel
    16s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    29-08-2024 16:18

General

  • Target

    $PLUGINSDIR/TvGetVersion.dll

  • Size

    50KB

  • MD5

    7d4cdffd78fa41a10e00cdfb899990d3

  • SHA1

    51c445cc7933a92efe285b11d5a8a80dc69d1be1

  • SHA256

    b5e3a463393887c08219366ac3efd60e8b4991df874586702950de2baa83104d

  • SHA512

    8044c3a25957f68d7b7fd9d925c26f6726af9b29ad54eaf4b1eb1a3027f6f07670c678ef3dd2958130634cc49406b2d2378e20a35a43b8821fcd4355551122f7

  • SSDEEP

    768:0VkG68qeXUmypSIRcu7Tx7Ss1xS+KCDpR/vO4nnZr11t5JgX:0Vm4Um4W4dLKopR/PnZft5

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TvGetVersion.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TvGetVersion.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 224
        3⤵
        • Program crash
        PID:2456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads