Resubmissions

05-11-2024 09:43

241105-lpwmlsydrh 7

05-11-2024 09:39

241105-lm15bazbnl 7

05-11-2024 09:32

241105-lh19hsxrbx 7

Analysis

  • max time kernel
    147s
  • max time network
    275s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-11-2024 09:39

General

  • Target

    8.10.0.0/YodaoDict7.dll

  • Size

    176KB

  • MD5

    4eca618c99ae526787e310d8178746e4

  • SHA1

    078167eeacadd0b676e05d798d588528b6f0c68d

  • SHA256

    1b3c86f7136bf11a9f71871ad49e3b0e4f5f6c704e9f3df39a1ee2013b8f79bc

  • SHA512

    d23ddd7b774a22db348ce05288f23bcf446e615a0763bf2ea4033af7b37ea1404f48316a07fcc3534b1257c37c2a8e63ea5bb1e34c9ca95239ac35b9f54a428d

  • SSDEEP

    3072:FhEQu54E4QhMT3gjMcH0iRmPVH4OMe/eBgtffF:FhEQhQhU3JcH06DOMeH

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\8.10.0.0\YodaoDict7.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4120
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\8.10.0.0\YodaoDict7.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 620
        3⤵
        • Program crash
        PID:4248
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2432 -ip 2432
    1⤵
      PID:2004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads