Overview
overview
10Static
static
3doc20240627-00073.exe
windows7-x64
10doc20240627-00073.exe
windows10-2004-x64
10$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 09:24
Static task
static1
Behavioral task
behavioral1
Sample
doc20240627-00073.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
doc20240627-00073.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240611-en
General
-
Target
$PLUGINSDIR/UserInfo.dll
-
Size
4KB
-
MD5
a6f622a2f12ac10bca04e23deff5cada
-
SHA1
abf851b5ccfb64004e9b49718a467bd754545887
-
SHA256
b8fa7b9393fff910144768588c471ca7c9ec98a2b8b186b2172b8ba7a5279500
-
SHA512
35c8b0db179104e638f1b40f3f8038a41fdc327e112de5cb0dbb97cbf1dfa276fcf6400fcb46b88cb5ba233ca769becbdb4b4d40920adca831e3c0f38193c50f
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2972 1284 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 1284 wrote to memory of 2972 1284 rundll32.exe WerFault.exe PID 1284 wrote to memory of 2972 1284 rundll32.exe WerFault.exe PID 1284 wrote to memory of 2972 1284 rundll32.exe WerFault.exe PID 1284 wrote to memory of 2972 1284 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 2203⤵
- Program crash