Analysis

  • max time kernel
    100s
  • max time network
    105s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/07/2025, 17:56

General

  • Target

    $PLUGINSDIR/BrowserInfo.dll

  • Size

    108KB

  • MD5

    4be82c145e3dbfbc87f9af51f81ae93c

  • SHA1

    866547f712dfc3db57111f90b01c11b3d1b25d53

  • SHA256

    06e80a77d89d4e536d130f0bc2c9cb430027b78f0c93da7bf7dc5d3aae7864fc

  • SHA512

    55f1d0b23dc7bdad491d4d99f98908041a20fd5ea5c004542f270e162fcaae822b00d4e70c5bd0a94fe032303f5d1bb004bce69e4469fd9290004be476ab0add

  • SSDEEP

    3072:c+JWJF72NtenOZsQBIqoAAWUhMJBD/PS2yP6NcFOfzA:zQj2NtelIzUhmrPC6NkOfzA

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BrowserInfo.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5216
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BrowserInfo.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5236
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 528
        3⤵
        • Program crash
        PID:2104
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5236 -ip 5236
    1⤵
      PID:2764

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads