Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 15:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
554ec4d69cf026ea7d7f43dd04b1a8f8705f276cc9aad04c2bb33ea5ed67cf1fN.dll
Resource
win7-20240708-en
3 signatures
120 seconds
General
-
Target
554ec4d69cf026ea7d7f43dd04b1a8f8705f276cc9aad04c2bb33ea5ed67cf1fN.dll
-
Size
64KB
-
MD5
c5bac1716cce18be2f2699693dc1fe10
-
SHA1
3d1173141ced72f012654b599aefecdca2c6cf1e
-
SHA256
554ec4d69cf026ea7d7f43dd04b1a8f8705f276cc9aad04c2bb33ea5ed67cf1f
-
SHA512
d2ffd88c938cf4dbd8ac81465e1f33a427bb700cf5aff8eec9bb8cd3976d1ff49f29b25fec362792c850b8f14f0fae53ed5d314c24ea6cbac9417f2ef4ad4277
-
SSDEEP
1536:8AjyMxsQK0ILlVr72gQB133yYh2F5FjsSLxnDOz:5uQKrv72gQvEZBnDO
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2664-4-0x00000000001C0000-0x00000000001CE000-memory.dmp upx behavioral1/memory/2664-8-0x00000000001C0000-0x00000000001CE000-memory.dmp upx behavioral1/memory/2664-7-0x00000000001C0000-0x00000000001CE000-memory.dmp upx behavioral1/memory/2664-0-0x00000000001C0000-0x00000000001CE000-memory.dmp upx behavioral1/memory/2664-6-0x00000000001C0000-0x00000000001CE000-memory.dmp upx behavioral1/memory/2664-3-0x00000000001C0000-0x00000000001CE000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 824 wrote to memory of 2664 824 rundll32.exe 31 PID 824 wrote to memory of 2664 824 rundll32.exe 31 PID 824 wrote to memory of 2664 824 rundll32.exe 31 PID 824 wrote to memory of 2664 824 rundll32.exe 31 PID 824 wrote to memory of 2664 824 rundll32.exe 31 PID 824 wrote to memory of 2664 824 rundll32.exe 31 PID 824 wrote to memory of 2664 824 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\554ec4d69cf026ea7d7f43dd04b1a8f8705f276cc9aad04c2bb33ea5ed67cf1fN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\554ec4d69cf026ea7d7f43dd04b1a8f8705f276cc9aad04c2bb33ea5ed67cf1fN.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2664
-