Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20251218-en - resource tags
arch:x64arch:x86image:win11-20251218-enlocale:en-usos:windows11-21h2-x64system - submitted
23/12/2025, 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
msedge_elf.dll
Resource
win10v2004-20251218-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
msedge_elf.dll
Resource
win11-20251218-en
3 signatures
150 seconds
General
- Target msedge_elf.dll
- Size 1.7MB
- Sample251223-n3deaswpdx
- SHA256 cdecb17866aa95ae171740ba4fc9b73b0f7a75ee817119fbe423b074c2c3e8a6
- MD5 5d00dde458c1a1334db921b6a19d305d
- SHA1 b310dc98ee5903eac07d6d003469a3f7caa36a13
- SHA512 4e31ca39399551b72a8c3b3d75ec6488b608ecdd59d0f9c63bb52600c4ce2ff378b57616ad186a16b4a8962bcd204b231fef84a76d8e4c90ca79d4bb6161a558
- SSDEEP 49152:Qrh9c3z0vPp4Gf3hClz7L/vfAtc+Y5WWQYBjG:+c3zQpWn8/bYs
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4976 set thread context of 2340 4976 rundll32.exe 77 - Program crash 1 IoCs
pid pid_target Process procid_target 5772 2340 WerFault.exe 77 - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4976 wrote to memory of 2340 4976 rundll32.exe 77 PID 4976 wrote to memory of 2340 4976 rundll32.exe 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msedge_elf.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵PID:2340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 163⤵
- Program crash
PID:5772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2340 -ip 23401⤵PID:3304