Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 18:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
598653d4bb43c79465a9334a2cd93ff4006ca9bc90c804ab7fd0bae633497d1f.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
120 seconds
General
-
Target
598653d4bb43c79465a9334a2cd93ff4006ca9bc90c804ab7fd0bae633497d1f.dll
-
Size
324KB
-
MD5
8788eea4f1adf87bf98b8e7b262c712b
-
SHA1
ffcdfcae82daa136a6ddb6ffd2c62fd3ad6030b0
-
SHA256
598653d4bb43c79465a9334a2cd93ff4006ca9bc90c804ab7fd0bae633497d1f
-
SHA512
8d9c27bde5449a281723e8f08abec736067799c56f99f910adc94436e37d2775df3f1656561ff33a0aa394067647f3db9607d84ba9ad1d3f6d3ed8d674b7355a
-
SSDEEP
6144:lMJOWK4l0wqOVq1DuGwH5ZIzE1BN2hcw//JI:l2OWK4llsux5ZEE1qVhI
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2060 wrote to memory of 1560 2060 rundll32.exe 30 PID 2060 wrote to memory of 1560 2060 rundll32.exe 30 PID 2060 wrote to memory of 1560 2060 rundll32.exe 30 PID 2060 wrote to memory of 1560 2060 rundll32.exe 30 PID 2060 wrote to memory of 1560 2060 rundll32.exe 30 PID 2060 wrote to memory of 1560 2060 rundll32.exe 30 PID 2060 wrote to memory of 1560 2060 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\598653d4bb43c79465a9334a2cd93ff4006ca9bc90c804ab7fd0bae633497d1f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\598653d4bb43c79465a9334a2cd93ff4006ca9bc90c804ab7fd0bae633497d1f.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1560
-