Analysis
-
max time kernel
1562s -
max time network
1562s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 18:26
Static task
static1
Behavioral task
behavioral1
Sample
Crown.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Crown.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Launcher.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Launcher.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
eventlog_provider.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
eventlog_provider.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
libEGL.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
libEGL.dll
Resource
win10v2004-20240611-en
General
-
Target
libEGL.dll
-
Size
469KB
-
MD5
2a568dc1f848b2948dfd90c8ebeb58c6
-
SHA1
e765ca8946ce091651c6722c650d9ad5edfeb5d5
-
SHA256
c00285c0174024739997898e98444deb4cbfe6b571cca69ca3bf8e5ab3ea5bbe
-
SHA512
a6ce4ead89933d32ea24766f887655ee5894ef1813faf97ebb2191a775488ba2fd77bcb4aedefc273ef85f5a93a9a5dd3d35b213a52d95b0cc4111708d9fcee5
-
SSDEEP
3072:4kgdNXYPuSHGjFXVYbAQSIoU8w1Z5iErbFdWE7D6i/wZJothADZX+Lcq7gv+xt4f:47Vl/HxUniSbFdH1/wXFufMG9x2qPz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2740 wrote to memory of 1776 2740 rundll32.exe WerFault.exe PID 2740 wrote to memory of 1776 2740 rundll32.exe WerFault.exe PID 2740 wrote to memory of 1776 2740 rundll32.exe WerFault.exe