Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 01:40

General

  • Target

    c17b17789eb5638b701d6418013366d4448e317aeb12a5d1ac70f12ed8cd5a39N.dll

  • Size

    3.0MB

  • MD5

    925d67844f0482b8869de167db1011e0

  • SHA1

    a0a3665247c5ec44981e9ccc290cc240f69dbb65

  • SHA256

    c17b17789eb5638b701d6418013366d4448e317aeb12a5d1ac70f12ed8cd5a39

  • SHA512

    6a6a2c6676ec29857e861d53a8b0596f2ee55bbe10d83067790ff8ba8fc81c8c91d6967acfaf6bbb5ebc7aab6eb8d8c1a9f44c4dffdf4d1a93a02c046cb23f05

  • SSDEEP

    24576:s34AdnbBTJwZYUMGNL/geFyNcTN+jv75TQn652VBuNyb:soAdb1eZYHGJtF4ch+jvNm0Nyb

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c17b17789eb5638b701d6418013366d4448e317aeb12a5d1ac70f12ed8cd5a39N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c17b17789eb5638b701d6418013366d4448e317aeb12a5d1ac70f12ed8cd5a39N.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2860-0-0x00000000037F0000-0x0000000003AF0000-memory.dmp

    Filesize

    3.0MB

  • memory/2860-1-0x00000000037F0000-0x0000000003AF0000-memory.dmp

    Filesize

    3.0MB