Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 05:17
Behavioral task
behavioral1
Sample
9e2251949cb4ee2309cc19303c3529efb725182a5fc9761e8b36240e56a38afaN.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
120 seconds
General
-
Target
9e2251949cb4ee2309cc19303c3529efb725182a5fc9761e8b36240e56a38afaN.dll
-
Size
98KB
-
MD5
0c6cfec3819d9c854276155823c94590
-
SHA1
3be2c134e242d7b2ecd8f96ab0ce2a4743efb3a3
-
SHA256
9e2251949cb4ee2309cc19303c3529efb725182a5fc9761e8b36240e56a38afa
-
SHA512
67ea743d40893677217e8bee90b980f0295a69e63be31453faafae627925a9ded80a68fd0810eca403067c30addcc49a687e9492110ade4a59ac04aac592f8de
-
SSDEEP
1536:0pstl9F0gv/r7r2ZyaXe49UYJJ8/rlUZKI8RCt4Vgn6BhgN2up2SswTO3GzB2:0OtFNv/r7r0phE/heKNRCtMBu/pswP2
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2844-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2844 2708 rundll32.exe 82 PID 2708 wrote to memory of 2844 2708 rundll32.exe 82 PID 2708 wrote to memory of 2844 2708 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e2251949cb4ee2309cc19303c3529efb725182a5fc9761e8b36240e56a38afaN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e2251949cb4ee2309cc19303c3529efb725182a5fc9761e8b36240e56a38afaN.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2844
-