Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 00:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2fcc0412df67cd6c5984e237a77efc04ba3739b72acd2d5f39bfa5a2333fd866.dll
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
General
-
Target
2fcc0412df67cd6c5984e237a77efc04ba3739b72acd2d5f39bfa5a2333fd866.dll
-
Size
783KB
-
MD5
a9cd25c63af66fc9800ce9a119524a41
-
SHA1
ed70474095400ae4aebc1ef08878be1053eeed1d
-
SHA256
2fcc0412df67cd6c5984e237a77efc04ba3739b72acd2d5f39bfa5a2333fd866
-
SHA512
7d6dccab6099001190767de6dd72656bd80a3e291627099849e2674a572a8309306f4c52d217e7e29735b0b77c4facbdfa351d76f3581c0bd29de5280ead7a6b
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0+:jDgtfRQUHPw06MoV2nwTBlhm82
Malware Config
Signatures
-
Yunsip family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1616 wrote to memory of 2928 1616 rundll32.exe 83 PID 1616 wrote to memory of 2928 1616 rundll32.exe 83 PID 1616 wrote to memory of 2928 1616 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2fcc0412df67cd6c5984e237a77efc04ba3739b72acd2d5f39bfa5a2333fd866.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2fcc0412df67cd6c5984e237a77efc04ba3739b72acd2d5f39bfa5a2333fd866.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2928
-