Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2024 06:24
Behavioral task
behavioral1
Sample
6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll
Resource
win10v2004-20241007-en
General
-
Target
6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll
-
Size
208KB
-
MD5
21ab34f3be5c64ba22369570a0c34745
-
SHA1
dc0a667bbc8354d2faadaa21c653befe0e328245
-
SHA256
6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4
-
SHA512
7abe689940ce5e131c0a1775ccb878894b24cc8ae9ca28b4a48dcf2c456fe4092681821d28e36406db19c9867fc911658a6e0bf5df5d5aaec846578db2710c25
-
SSDEEP
3072:LI6CqRCxffkClZ8Cqn7LQlRw6x+Y3CxT2DtK5jdUaY5:LIDff9D8CcXYRw6MT2DEj
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4436 3672 WerFault.exe rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2360 wrote to memory of 3672 2360 rundll32.exe rundll32.exe PID 2360 wrote to memory of 3672 2360 rundll32.exe rundll32.exe PID 2360 wrote to memory of 3672 2360 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6c7571c64b57f407536511f99c0632bbd2f692ca53f16eeab0f15238597a4fb4.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 6323⤵
- Program crash
PID:4436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 36721⤵PID:4132