Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 00:26
Behavioral task
behavioral1
Sample
4fbd8120d6ac1240f5bfdf4b387d3cb9fa38f0d613de9e8cbddae7777f13040d.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4fbd8120d6ac1240f5bfdf4b387d3cb9fa38f0d613de9e8cbddae7777f13040d.dll
Resource
win10v2004-20241007-en
General
-
Target
4fbd8120d6ac1240f5bfdf4b387d3cb9fa38f0d613de9e8cbddae7777f13040d.dll
-
Size
2.1MB
-
MD5
435487b90c1756a36e4317342eac8a31
-
SHA1
3dff28feb6c905923caa74ae9b48d7c0953c7fe0
-
SHA256
4fbd8120d6ac1240f5bfdf4b387d3cb9fa38f0d613de9e8cbddae7777f13040d
-
SHA512
da20256da551af53fc12b491883afe6a4748367b46dbcc3968d77956a6ff5d2d48d7dbfcedbf1b5f931a3c460806f3939f112966d930c1a5525c6e5e91edb85c
-
SSDEEP
49152:BhOjMNrC+fy6hSDfVJBPVuNFs2iXyo0lEE43n:BcR6A3mFsJXynEFn
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2592 1832 rundll32.exe 30 PID 1832 wrote to memory of 2592 1832 rundll32.exe 30 PID 1832 wrote to memory of 2592 1832 rundll32.exe 30 PID 1832 wrote to memory of 2592 1832 rundll32.exe 30 PID 1832 wrote to memory of 2592 1832 rundll32.exe 30 PID 1832 wrote to memory of 2592 1832 rundll32.exe 30 PID 1832 wrote to memory of 2592 1832 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4fbd8120d6ac1240f5bfdf4b387d3cb9fa38f0d613de9e8cbddae7777f13040d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4fbd8120d6ac1240f5bfdf4b387d3cb9fa38f0d613de9e8cbddae7777f13040d.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2592
-