Resubmissions
04/06/2025, 17:18
250604-vvjpnssyav 604/06/2025, 17:11
250604-vp9nxaaj2y 1004/06/2025, 16:57
250604-vf9ybahp6v 3Analysis
-
max time kernel
0s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/06/2025, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
version.dll
Resource
win10ltsc2021-20250425-en
Behavioral task
behavioral2
Sample
version.dll
Resource
win11-20250502-en
General
-
Target
version.dll
-
Size
2.7MB
-
MD5
40c2231241385e75bea54c1408a94881
-
SHA1
e8a255003325077bb8b4990084d09c32cba827f3
-
SHA256
972d58a325c303624e7ee5e10263c6ec3676ccc05755e2cd73b0b8ff7eef9f0e
-
SHA512
559d561b0b2521ceefcf098539976f27a9e0678a7f1976ba0044f6d713fd541a41a0e6025c57b7ce116fef1eaaf566fc51d8f3acb4f2df65a4fb02c7d3028645
-
SSDEEP
49152:IKtXyGVrSRE665kUv3OJPGhhCNoEcKPvzsClA4nyk2bBF83EqAXVhfQ93pO/rf7q:lrSREf3O59EKMFOZ30/
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 956 2952 WerFault.exe 78 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5720 wrote to memory of 2952 5720 rundll32.exe 78 PID 5720 wrote to memory of 2952 5720 rundll32.exe 78 PID 5720 wrote to memory of 2952 5720 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 5283⤵
- Program crash
PID:956
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2952 -ip 29521⤵PID:5248