Analysis
-
max time kernel
95s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll
Resource
win10v2004-20241007-en
General
-
Target
ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll
-
Size
3KB
-
MD5
b189d37aae93d5d966e67260fc581440
-
SHA1
e88be17870633b7c174b44b41e8f17b957a26493
-
SHA256
ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347b
-
SHA512
40b8b1ac60429b1a55791f1a0192bf1a280ae6a3c5dffcedc2708a220dd362de53142d740393882e6214e90750ac41972b6980b70b47a80c04a9c66ee0a53870
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2556 wrote to memory of 1476 2556 rundll32.exe 83 PID 2556 wrote to memory of 1476 2556 rundll32.exe 83 PID 2556 wrote to memory of 1476 2556 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca0cd8df93383f6c78d6d20b81d58b0205102c46cb901fdd4e21bc5fafe0347bN.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1476
-