Analysis
-
max time kernel
73s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll
Resource
win10v2004-20241007-en
General
-
Target
ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll
-
Size
3KB
-
MD5
b189d37aae93d5d966e67260fc581440
-
SHA1
e88be17870633b7c174b44b41e8f17b957a26493
-
SHA256
ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347b
-
SHA512
40b8b1ac60429b1a55791f1a0192bf1a280ae6a3c5dffcedc2708a220dd362de53142d740393882e6214e90750ac41972b6980b70b47a80c04a9c66ee0a53870
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 628 wrote to memory of 2748 628 rundll32.exe 31 PID 628 wrote to memory of 2748 628 rundll32.exe 31 PID 628 wrote to memory of 2748 628 rundll32.exe 31 PID 628 wrote to memory of 2748 628 rundll32.exe 31 PID 628 wrote to memory of 2748 628 rundll32.exe 31 PID 628 wrote to memory of 2748 628 rundll32.exe 31 PID 628 wrote to memory of 2748 628 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2748
-