Overview
overview
3Static
static
3BpmSyncVmd...IR.dll
windows11-21h2-x64
3BpmSyncVmd...15.dll
windows11-21h2-x64
3BpmSyncVmd...ry.exe
windows11-21h2-x64
3BpmSyncVmd...32.dll
windows11-21h2-x64
3BpmSyncVmd...it.dll
windows11-21h2-x64
3BpmSyncVmd...cp.dll
windows11-21h2-x64
3BpmSyncVmd...or.exe
windows11-21h2-x64
3Analysis
-
max time kernel
1463s -
max time network
1479s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/10/2024, 01:13
Static task
static1
Behavioral task
behavioral1
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Adobe AIR.dll
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/adobecp.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
BpmSyncVmdGenerator/BpmSyncVmdGenerator.exe
Resource
win11-20241007-en
General
-
Target
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
-
Size
44KB
-
MD5
03deedcc711db3b75d18274f7c7a3c5c
-
SHA1
a6fe208fb7437851b7e0928bbb1bd426bf5af8ed
-
SHA256
0a69709a7c3b21af3733cbcdf12eee9f94a42e22faf7525f0fca9ef8b9252c0f
-
SHA512
015d4446fab2ed5c89e4917e4ada960c5f633517c234be2150bddd31d03b5c1e69771b3d226b299512bc579d51ae6c3b8d2bbc3945d70bf5f163fb7d34b7901e
-
SSDEEP
384:Be61wzgQcJSIumB3DHlctUWDfKCdz90IXZsHLMGj5JNNzFwhhi1U:BeYEtIlzmthDfK27U9J3whaU
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2692 908 WerFault.exe 77 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2256 wrote to memory of 908 2256 rundll32.exe 77 PID 2256 wrote to memory of 908 2256 rundll32.exe 77 PID 2256 wrote to memory of 908 2256 rundll32.exe 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\BpmSyncVmdGenerator\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\BpmSyncVmdGenerator\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 5083⤵
- Program crash
PID:2692
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 908 -ip 9081⤵PID:948