Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31-10-2024 08:25
Static task
static1
Behavioral task
behavioral1
Sample
31a90c59ea78df47d4441cc7e4d34c6fb05806f66855cbfc89185c4976e7b574N.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
31a90c59ea78df47d4441cc7e4d34c6fb05806f66855cbfc89185c4976e7b574N.dll
Resource
win10v2004-20241007-en
General
-
Target
31a90c59ea78df47d4441cc7e4d34c6fb05806f66855cbfc89185c4976e7b574N.dll
-
Size
4KB
-
MD5
c01ee8290104f608c32d45bb2061da60
-
SHA1
4514017187561329c42e48e9885200d1c995d6bc
-
SHA256
31a90c59ea78df47d4441cc7e4d34c6fb05806f66855cbfc89185c4976e7b574
-
SHA512
57ede8f40ab386dd59160ab33843d54e134a3e273418c7c8daaf51e64c1adfd1e864ff0abacba0f8a8440a6b2e63dd0df3798af192304d9207ef104377670f1a
-
SSDEEP
48:SWkO0IoyTnXz+ihZjok5bEgBdnPnKh80GSCngSGuekJz0dzn:ZJTnXzvokSknq80GTgS3z0hn
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2460 2500 rundll32.exe 30 PID 2500 wrote to memory of 2460 2500 rundll32.exe 30 PID 2500 wrote to memory of 2460 2500 rundll32.exe 30 PID 2500 wrote to memory of 2460 2500 rundll32.exe 30 PID 2500 wrote to memory of 2460 2500 rundll32.exe 30 PID 2500 wrote to memory of 2460 2500 rundll32.exe 30 PID 2500 wrote to memory of 2460 2500 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31a90c59ea78df47d4441cc7e4d34c6fb05806f66855cbfc89185c4976e7b574N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31a90c59ea78df47d4441cc7e4d34c6fb05806f66855cbfc89185c4976e7b574N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2460
-