Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 00:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d5192c645b46f6cf65e5ddb0083efa843b5bc4a2664c7923da1536d0cc2ea98.dll
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
General
-
Target
1d5192c645b46f6cf65e5ddb0083efa843b5bc4a2664c7923da1536d0cc2ea98.dll
-
Size
1.0MB
-
MD5
f7bfa44a87f7b5076cc263d4c0955f34
-
SHA1
f84407ac484e7c08aade8e9666801d0f804023ba
-
SHA256
1d5192c645b46f6cf65e5ddb0083efa843b5bc4a2664c7923da1536d0cc2ea98
-
SHA512
bfcb1de258bf5b59f9b952da714c8f250771933e0d24f9b7ea9ac8091cc8910c97f312d71d28734f57099b06fe947f9d3bc8c73aedcfac213a85e4720abceae6
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0S:jDgtfRQUHPw06MoV2nwTBlhm8q
Malware Config
Signatures
-
Yunsip family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4856 wrote to memory of 4708 4856 rundll32.exe 82 PID 4856 wrote to memory of 4708 4856 rundll32.exe 82 PID 4856 wrote to memory of 4708 4856 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1d5192c645b46f6cf65e5ddb0083efa843b5bc4a2664c7923da1536d0cc2ea98.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1d5192c645b46f6cf65e5ddb0083efa843b5bc4a2664c7923da1536d0cc2ea98.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4708
-