Resubmissions

05-11-2024 09:43

241105-lpwmlsydrh 7

05-11-2024 09:39

241105-lm15bazbnl 7

05-11-2024 09:32

241105-lh19hsxrbx 7

Analysis

  • max time kernel
    143s
  • max time network
    210s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-11-2024 09:39

General

  • Target

    8.10.0.0/YodaoDict.dll

  • Size

    176KB

  • MD5

    260d438b13406700bbcdabdba2c2d43c

  • SHA1

    7c413b4c8f96beac86895a35bc285de6f3576f07

  • SHA256

    4edd999c04f77ba491dbcd97d2771f7453d99507e546d99c05397f33afa9ff34

  • SHA512

    a8187d3d29b80116fb26332ad682d4246320586132733a0a3d60d17658ddf69e6a3199dd6b94025d9753ded74a8f283af95386857b4f598142a9208efee05b18

  • SSDEEP

    3072:PC/MHRC+hoF92jLwT1hQ6uJkc0Kq6uZUnPUxRYZu3tWzObBqX:PC/MHCF92HwPQ6uJkoq6EUcCl

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\8.10.0.0\YodaoDict.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\8.10.0.0\YodaoDict.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3916
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 620
        3⤵
        • Program crash
        PID:1640
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3916 -ip 3916
    1⤵
      PID:5116

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads