Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-10-2024 06:24
Behavioral task
behavioral1
Sample
6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll
Resource
win10v2004-20241007-en
General
-
Target
6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll
-
Size
208KB
-
MD5
21ab34f3be5c64ba22369570a0c34745
-
SHA1
dc0a667bbc8354d2faadaa21c653befe0e328245
-
SHA256
6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4
-
SHA512
7abe689940ce5e131c0a1775ccb878894b24cc8ae9ca28b4a48dcf2c456fe4092681821d28e36406db19c9867fc911658a6e0bf5df5d5aaec846578db2710c25
-
SSDEEP
3072:LI6CqRCxffkClZ8Cqn7LQlRw6x+Y3CxT2DtK5jdUaY5:LIDff9D8CcXYRw6MT2DEj
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2764 3060 WerFault.exe rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2132 wrote to memory of 3060 2132 rundll32.exe rundll32.exe PID 2132 wrote to memory of 3060 2132 rundll32.exe rundll32.exe PID 2132 wrote to memory of 3060 2132 rundll32.exe rundll32.exe PID 2132 wrote to memory of 3060 2132 rundll32.exe rundll32.exe PID 2132 wrote to memory of 3060 2132 rundll32.exe rundll32.exe PID 2132 wrote to memory of 3060 2132 rundll32.exe rundll32.exe PID 2132 wrote to memory of 3060 2132 rundll32.exe rundll32.exe PID 3060 wrote to memory of 2764 3060 rundll32.exe WerFault.exe PID 3060 wrote to memory of 2764 3060 rundll32.exe WerFault.exe PID 3060 wrote to memory of 2764 3060 rundll32.exe WerFault.exe PID 3060 wrote to memory of 2764 3060 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 2283⤵
- Program crash
PID:2764