Resubmissions

29-09-2024 15:11

240929-sk3npaseqc 3

29-09-2024 15:08

240929-sh684aygkk 3

29-09-2024 15:07

240929-shbr7ayfqn 7

Analysis

  • max time kernel
    205s
  • max time network
    264s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29-09-2024 15:08

General

  • Target

    SS_DL.dll

  • Size

    2.4MB

  • MD5

    28264b046fb1adff61c4372d53e3d633

  • SHA1

    8c7b6e25e2d8a50b763f7617196d451f703e7bd3

  • SHA256

    66047e604bca2ef6562059279a33865b80554535a051fc58919a1227674f4d2c

  • SHA512

    7cccee528e90168222f2ffd8d78cf483278586cce1c872b6e0e31d57e8574b19a71079ae382fb5ccb3bcae6c302d4c6469d29f365a0edcae73b33a4ad5ab03fa

  • SSDEEP

    49152:cHyzwwebNuaLn5x6kn8PzioU5v6HcjalGfnXwSC0kS1F2LTp0E3:cHyzw/N7Ln1n8PzrU5v6HcjKknA10kS1

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SS_DL.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\SS_DL.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1016
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 676
        3⤵
        • Program crash
        PID:216

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads