Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 20:19
Static task
static1
Behavioral task
behavioral1
Sample
003dfb782d64502f646a59bff933edc9536ef7f1d931102258e171df55edd962.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
003dfb782d64502f646a59bff933edc9536ef7f1d931102258e171df55edd962.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
003dfb782d64502f646a59bff933edc9536ef7f1d931102258e171df55edd962.dll
-
Size
5.7MB
-
MD5
605877b12b569798f00c1a617b7364df
-
SHA1
bd0232ab15a090e4d4227cbfca5ae251b91c6128
-
SHA256
003dfb782d64502f646a59bff933edc9536ef7f1d931102258e171df55edd962
-
SHA512
e94fea664192ddd2859255dd7131f18372b8ab8a86cabe551c058403f2bf4bd5989380db36bffa3a988a7704cbd8e8698c4b0e88441dd23717bddfc29f75ff09
-
SSDEEP
98304:q/o6Ow9PZViLBmrTaPMJxFafWxnZltMafkgPutUSDMXHvV81MNms+35zCa/ZCAK5:KZViErTaPMJxFafW9tMUk++RiHvVUEmS
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe 2176 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3684 wrote to memory of 2176 3684 rundll32.exe 83 PID 3684 wrote to memory of 2176 3684 rundll32.exe 83 PID 3684 wrote to memory of 2176 3684 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\003dfb782d64502f646a59bff933edc9536ef7f1d931102258e171df55edd962.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\003dfb782d64502f646a59bff933edc9536ef7f1d931102258e171df55edd962.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2176
-