Analysis
-
max time kernel
93s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 23:57
Behavioral task
behavioral1
Sample
646923c67653efcdb73eaf4472d7646e3c8a463de3dd6a7f9e5f899b30dbae17N.dll
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
646923c67653efcdb73eaf4472d7646e3c8a463de3dd6a7f9e5f899b30dbae17N.dll
-
Size
76KB
-
MD5
dee7e371c2354ee7b3e5f95fe2a5cd70
-
SHA1
ab45ea49924f7d6ebb88c9021b1a4366acc2b5b0
-
SHA256
646923c67653efcdb73eaf4472d7646e3c8a463de3dd6a7f9e5f899b30dbae17
-
SHA512
f17a7490bea6c1c4ad7abf96c19e958b1b27483eb0988a1beebcb9f718eb00db6976a33c0541522b1f8a8b4669901f420896cb210d03b49a71bb88bc1a5805e2
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z9LK2Q0h:c8y93KQjy7G55riF1cMo03jLPTh
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5004-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/5004-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3572 5004 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5004 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3320 wrote to memory of 5004 3320 rundll32.exe 83 PID 3320 wrote to memory of 5004 3320 rundll32.exe 83 PID 3320 wrote to memory of 5004 3320 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\646923c67653efcdb73eaf4472d7646e3c8a463de3dd6a7f9e5f899b30dbae17N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\646923c67653efcdb73eaf4472d7646e3c8a463de3dd6a7f9e5f899b30dbae17N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 7163⤵
- Program crash
PID:3572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5004 -ip 50041⤵PID:3392