Analysis
-
max time kernel
95s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
26/02/2025, 16:16
Behavioral task
behavioral1
Sample
607582d0cad3d73762d08a920e311e4c29cc452a0a4c075cbf11342821cf3058.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
607582d0cad3d73762d08a920e311e4c29cc452a0a4c075cbf11342821cf3058.dll
Resource
win10v2004-20250217-en
General
-
Target
607582d0cad3d73762d08a920e311e4c29cc452a0a4c075cbf11342821cf3058.dll
-
Size
127KB
-
MD5
e8efd01b4952e9cd3166fb10f3dbea00
-
SHA1
18e696d272a9b9ad41c383290d9071ccd7b4932c
-
SHA256
607582d0cad3d73762d08a920e311e4c29cc452a0a4c075cbf11342821cf3058
-
SHA512
71f16eb2a0b7d71e2856cb48e8a1b46fe30268518b014639d95899d6dd80edac83352767031d4707262ca77618b401ee04ebd488b545fbb7934167fdf00c1fda
-
SSDEEP
1536:h+sRWd4nhueU5u2s1N/47TVWeBeu644kPOLD38lKHPEryZ21uZjYCBA3MpM7c8uS:5sURE3VW8POLwlKb21uRYCuLMF6eLkn
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1884 3552 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1592 wrote to memory of 3552 1592 rundll32.exe 85 PID 1592 wrote to memory of 3552 1592 rundll32.exe 85 PID 1592 wrote to memory of 3552 1592 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\607582d0cad3d73762d08a920e311e4c29cc452a0a4c075cbf11342821cf3058.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\607582d0cad3d73762d08a920e311e4c29cc452a0a4c075cbf11342821cf3058.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 6003⤵
- Program crash
PID:1884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3552 -ip 35521⤵PID:1956