Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/10/2024, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
8d0f83026970356c75221aa6a1be2d3a8dc37f17bb6ab31f81458fe95c5c6316N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8d0f83026970356c75221aa6a1be2d3a8dc37f17bb6ab31f81458fe95c5c6316N.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/inetc.dll
-
Size
21KB
-
MD5
92ec4dd8c0ddd8c4305ae1684ab65fb0
-
SHA1
d850013d582a62e502942f0dd282cc0c29c4310e
-
SHA256
5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
-
SHA512
581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
-
SSDEEP
384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2428 2392 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2392 2072 rundll32.exe 30 PID 2072 wrote to memory of 2392 2072 rundll32.exe 30 PID 2072 wrote to memory of 2392 2072 rundll32.exe 30 PID 2072 wrote to memory of 2392 2072 rundll32.exe 30 PID 2072 wrote to memory of 2392 2072 rundll32.exe 30 PID 2072 wrote to memory of 2392 2072 rundll32.exe 30 PID 2072 wrote to memory of 2392 2072 rundll32.exe 30 PID 2392 wrote to memory of 2428 2392 rundll32.exe 31 PID 2392 wrote to memory of 2428 2392 rundll32.exe 31 PID 2392 wrote to memory of 2428 2392 rundll32.exe 31 PID 2392 wrote to memory of 2428 2392 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 2363⤵
- Program crash
PID:2428
-
-