Analysis
-
max time kernel
15s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:23
Behavioral task
behavioral1
Sample
2d3f7d60c5cbea60fb42fbf63f15d445aabdff4a06652cf6deedc9fbf88d5e6c.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2d3f7d60c5cbea60fb42fbf63f15d445aabdff4a06652cf6deedc9fbf88d5e6c.dll
Resource
win10v2004-20241007-en
General
-
Target
2d3f7d60c5cbea60fb42fbf63f15d445aabdff4a06652cf6deedc9fbf88d5e6c.dll
-
Size
281KB
-
MD5
462ebd15e0e2c6b52d4abbb41da987a9
-
SHA1
a57b5924983aef79a50637cf758949d8921a5b53
-
SHA256
2d3f7d60c5cbea60fb42fbf63f15d445aabdff4a06652cf6deedc9fbf88d5e6c
-
SHA512
e80e91d560f2a1eac0b8635c4b96eaf98bc6c9c197f4971531b57ec48934ce8d7c50be6b1900a1330723df82168f9bc2f443cb4bd0081fb39520405240713ee9
-
SSDEEP
3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15adYke/wZU2PWOqZFivvef+xM65d4:PjdFKdoSxvixTxUAHh/w2GWz3fmM7
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2164 2916 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2916 2500 rundll32.exe 30 PID 2500 wrote to memory of 2916 2500 rundll32.exe 30 PID 2500 wrote to memory of 2916 2500 rundll32.exe 30 PID 2500 wrote to memory of 2916 2500 rundll32.exe 30 PID 2500 wrote to memory of 2916 2500 rundll32.exe 30 PID 2500 wrote to memory of 2916 2500 rundll32.exe 30 PID 2500 wrote to memory of 2916 2500 rundll32.exe 30 PID 2916 wrote to memory of 2164 2916 rundll32.exe 31 PID 2916 wrote to memory of 2164 2916 rundll32.exe 31 PID 2916 wrote to memory of 2164 2916 rundll32.exe 31 PID 2916 wrote to memory of 2164 2916 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2d3f7d60c5cbea60fb42fbf63f15d445aabdff4a06652cf6deedc9fbf88d5e6c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2d3f7d60c5cbea60fb42fbf63f15d445aabdff4a06652cf6deedc9fbf88d5e6c.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 2443⤵
- Program crash
PID:2164
-
-