Analysis
-
max time kernel
96s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/01/2025, 15:48 UTC
General
-
Target
real shit/api-ms-win-core-processthreads-l1-1-0.dll
-
Size
13KB
-
MD5
1641a8027af5a754dd164d6044917014
-
SHA1
5577d0be9d5d3874448e9f2c77286870c05f6d1d
-
SHA256
f8c0711a512059c648e83bef2f5b23119a454f457496e1dfead71d6942298863
-
SHA512
dded04a5211fe7762952afe39d51fa3540c0d7025c19468d2b5218f58bdd88043977f9eff99aa33decb6599bb3a4dd2a326cf9fc4fd7f6c4f3d38ef18e77d339
-
SSDEEP
384:1Hk1JzBcKcIpWphW8wGyaGECifl/zdbQD:1+cKc1/tzO
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\real shit\api-ms-win-core-processthreads-l1-1-0.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\real shit\api-ms-win-core-processthreads-l1-1-0.dll",#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 6003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2032 -ip 20321⤵
Network
-
DNS210.156.23.2.in-addr.arpaRemote address:8.8.8.8:53Request210.156.23.2.in-addr.arpaIN PTRResponse210.156.23.2.in-addr.arpaIN PTRa2-23-156-210deploystaticakamaitechnologiescom -
DNS217.106.137.52.in-addr.arpaRemote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
DNS69.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request69.31.126.40.in-addr.arpaIN PTRResponse
-
DNS3.108.50.23.in-addr.arpaRemote address:8.8.8.8:53Request3.108.50.23.in-addr.arpaIN PTRResponse3.108.50.23.in-addr.arpaIN PTRa23-50-108-3deploystaticakamaitechnologiescom
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS197.87.175.4.in-addr.arpaRemote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS130.118.77.104.in-addr.arpaRemote address:8.8.8.8:53Request130.118.77.104.in-addr.arpaIN PTRResponse130.118.77.104.in-addr.arpaIN PTRa104-77-118-130deploystaticakamaitechnologiescom
-
DNS98.250.22.2.in-addr.arpaRemote address:8.8.8.8:53Request98.250.22.2.in-addr.arpaIN PTRResponse98.250.22.2.in-addr.arpaIN PTRa2-22-250-98deploystaticakamaitechnologiescom
-
DNS19.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:53210.156.23.2.in-addr.arpadns
DNS Request
210.156.23.2.in-addr.arpa
-
8.8.8.8:53217.106.137.52.in-addr.arpadns
DNS Request
217.106.137.52.in-addr.arpa
-
8.8.8.8:5369.31.126.40.in-addr.arpadns
DNS Request
69.31.126.40.in-addr.arpa
-
8.8.8.8:533.108.50.23.in-addr.arpadns
DNS Request
3.108.50.23.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:53197.87.175.4.in-addr.arpadns
DNS Request
197.87.175.4.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:53130.118.77.104.in-addr.arpadns
DNS Request
130.118.77.104.in-addr.arpa
-
8.8.8.8:5398.250.22.2.in-addr.arpadns
DNS Request
98.250.22.2.in-addr.arpa
-
8.8.8.8:5319.229.111.52.in-addr.arpadns
DNS Request
19.229.111.52.in-addr.arpa