Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 02:57
Behavioral task
behavioral1
Sample
2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3.dll
Resource
win10v2004-20241007-en
General
-
Target
2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3.dll
-
Size
124KB
-
MD5
7fe5b933ed9391ea24647479c80e904e
-
SHA1
963721e46b8056e2e883c598e95d7daa7bdf8d9b
-
SHA256
2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3
-
SHA512
82d92d0c5155fff5ce97099cb9e78422ff328e0c516fbab7634e624215366c2191ec6ff6fe8d939268275c6770accb208af7ac69c3cc13c9188a49ef41339bb0
-
SSDEEP
3072:wdkSZXB8ZuzQT7SgmEE8An/Y4Z3SNq6ZidU1ep/:LoGymSgjE8A3Z3yodUwp/
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:536
-