Analysis
-
max time kernel
93s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
496f5775ba3797306d0839723da2eec4ba5039c57895f2ef0ecebfd405eea4f9.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
496f5775ba3797306d0839723da2eec4ba5039c57895f2ef0ecebfd405eea4f9.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
496f5775ba3797306d0839723da2eec4ba5039c57895f2ef0ecebfd405eea4f9.dll
-
Size
5.7MB
-
MD5
76fcabf946390fa13535392cb9fbaed6
-
SHA1
39117c802fa715ab1e787998b5ba2130414c81b4
-
SHA256
496f5775ba3797306d0839723da2eec4ba5039c57895f2ef0ecebfd405eea4f9
-
SHA512
d4c110649934e4df08b6411e1f0cbe021ccae819643e2a07f6c44c4561f4c0de8e15a4e95c422513245684fcdb970aaae7e0e897f3be3d04ec40fef46ffa4f51
-
SSDEEP
98304:q/o6Ow9PZViLBmrTaPMJxFafWxnZltMafkgPutUSDMXHvV81MNms+35zCa/ZCAKn:KZViErTaPMJxFafW9tMUk++RiHvVUEmk
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2708 wrote to memory of 1888 2708 rundll32.exe 85 PID 2708 wrote to memory of 1888 2708 rundll32.exe 85 PID 2708 wrote to memory of 1888 2708 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\496f5775ba3797306d0839723da2eec4ba5039c57895f2ef0ecebfd405eea4f9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\496f5775ba3797306d0839723da2eec4ba5039c57895f2ef0ecebfd405eea4f9.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1888
-