Analysis
-
max time kernel
148s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 01:23
Static task
static1
Behavioral task
behavioral1
Sample
6e280cf0d3ef0b8668f9b6482c2c13ff8db2ea7c6579d44e0948d553ce930fe9.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6e280cf0d3ef0b8668f9b6482c2c13ff8db2ea7c6579d44e0948d553ce930fe9.dll
Resource
win10v2004-20240802-en
General
-
Target
6e280cf0d3ef0b8668f9b6482c2c13ff8db2ea7c6579d44e0948d553ce930fe9.dll
-
Size
5.3MB
-
MD5
09f9fd01ab4f617ad6b26031ae342eae
-
SHA1
5f2e565939bf6c153509b283e83b7cedf7e321e6
-
SHA256
6e280cf0d3ef0b8668f9b6482c2c13ff8db2ea7c6579d44e0948d553ce930fe9
-
SHA512
46a1f01f2726ac55728fed48d50b7dd8c62c3817ca41c82cd3f1ef5b160624638d74e0788f07ebde06436c5168c0995ff95af2bc3eb1151cfd776d66ad01150c
-
SSDEEP
98304:FjtbrskkvWZfCeB0FjRJsv6tWKFdu9CjDOYDw0Gz7EtTtIo:PbWlRJsv6tWKFdu9CjiYsITl
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3808 wrote to memory of 1832 3808 rundll32.exe 83 PID 3808 wrote to memory of 1832 3808 rundll32.exe 83 PID 3808 wrote to memory of 1832 3808 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6e280cf0d3ef0b8668f9b6482c2c13ff8db2ea7c6579d44e0948d553ce930fe9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6e280cf0d3ef0b8668f9b6482c2c13ff8db2ea7c6579d44e0948d553ce930fe9.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1832
-