Analysis
-
max time kernel
97s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 11:36
Behavioral task
behavioral1
Sample
f12c07869b3e70baf1560a5427e074e4306cc251f6514b78487ee679b2ba0e97N.dll
Resource
win7-20241010-en
windows7-x64
5 signatures
120 seconds
General
-
Target
f12c07869b3e70baf1560a5427e074e4306cc251f6514b78487ee679b2ba0e97N.dll
-
Size
76KB
-
MD5
dfaf2f3bcf4006b0b20099ccb729bb80
-
SHA1
52e20c494a453e1971f15eb2df4243306f0222b5
-
SHA256
f12c07869b3e70baf1560a5427e074e4306cc251f6514b78487ee679b2ba0e97
-
SHA512
2d5f0487e85a9d990bdbfb61bb7f58c2c48b0730eb6c3daa6b1743b0d3e6cf8cd396930fe66e4fa9b5bc67dc727ebe6c8cb9afb183a4a5549a988b132b12078c
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZH4g829b/OT1/V:c8y93KQjy7G55riF1cMo03V782LW
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3984-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3984-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 804 3984 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3984 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4556 wrote to memory of 3984 4556 rundll32.exe 83 PID 4556 wrote to memory of 3984 4556 rundll32.exe 83 PID 4556 wrote to memory of 3984 4556 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f12c07869b3e70baf1560a5427e074e4306cc251f6514b78487ee679b2ba0e97N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f12c07869b3e70baf1560a5427e074e4306cc251f6514b78487ee679b2ba0e97N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 7003⤵
- Program crash
PID:804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3984 -ip 39841⤵PID:1988