Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2024, 04:18 UTC
Behavioral task
behavioral1
Sample
49f4cb4e44503357e0ea555da2ed792dba05581ea3ff0c363ce3d28716a0a32c.dll
Resource
win7-20240903-en
5 signatures
120 seconds
General
-
Target
49f4cb4e44503357e0ea555da2ed792dba05581ea3ff0c363ce3d28716a0a32c.dll
-
Size
76KB
-
MD5
9fbcf468b6337e4988b24bb1ab54a7be
-
SHA1
ed6ceede2abf4ccdb2046e81f28748ddfbe0a885
-
SHA256
49f4cb4e44503357e0ea555da2ed792dba05581ea3ff0c363ce3d28716a0a32c
-
SHA512
fdc3bc463bed35faac2f6e3d573544416356b685e44be4e8a509b4f5686296e67f23b7cc5a2703e3575a5285bffb578497f03d75a85a59a77dce4dbe5252ff71
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZOLpZIPe:c8y93KQjy7G55riF1cMo03oLpUe
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4240-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4240-2-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2208 4240 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4240 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2976 wrote to memory of 4240 2976 rundll32.exe 83 PID 2976 wrote to memory of 4240 2976 rundll32.exe 83 PID 2976 wrote to memory of 4240 2976 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\49f4cb4e44503357e0ea555da2ed792dba05581ea3ff0c363ce3d28716a0a32c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\49f4cb4e44503357e0ea555da2ed792dba05581ea3ff0c363ce3d28716a0a32c.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 7003⤵
- Program crash
PID:2208
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4240 -ip 42401⤵PID:4420
Network
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
No results found
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
68.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa