Resubmissions

04/06/2025, 17:18

250604-vvjpnssyav 6

04/06/2025, 17:11

250604-vp9nxaaj2y 10

04/06/2025, 16:57

250604-vf9ybahp6v 3

Analysis

  • max time kernel
    0s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/06/2025, 16:57

General

  • Target

    version.dll

  • Size

    2.7MB

  • MD5

    40c2231241385e75bea54c1408a94881

  • SHA1

    e8a255003325077bb8b4990084d09c32cba827f3

  • SHA256

    972d58a325c303624e7ee5e10263c6ec3676ccc05755e2cd73b0b8ff7eef9f0e

  • SHA512

    559d561b0b2521ceefcf098539976f27a9e0678a7f1976ba0044f6d713fd541a41a0e6025c57b7ce116fef1eaaf566fc51d8f3acb4f2df65a4fb02c7d3028645

  • SSDEEP

    49152:IKtXyGVrSRE665kUv3OJPGhhCNoEcKPvzsClA4nyk2bBF83EqAXVhfQ93pO/rf7q:lrSREf3O59EKMFOZ30/

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5720
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 528
        3⤵
        • Program crash
        PID:956
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2952 -ip 2952
    1⤵
      PID:5248

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads