Overview
overview
10Static
static
3doc2024062...at.exe
windows7-x64
10doc2024062...at.exe
windows10-2004-x64
10$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 09:29
Static task
static1
Behavioral task
behavioral1
Sample
doc20240627-00073.bat.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
doc20240627-00073.bat.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/UserInfo.dll
-
Size
4KB
-
MD5
a6f622a2f12ac10bca04e23deff5cada
-
SHA1
abf851b5ccfb64004e9b49718a467bd754545887
-
SHA256
b8fa7b9393fff910144768588c471ca7c9ec98a2b8b186b2172b8ba7a5279500
-
SHA512
35c8b0db179104e638f1b40f3f8038a41fdc327e112de5cb0dbb97cbf1dfa276fcf6400fcb46b88cb5ba233ca769becbdb4b4d40920adca831e3c0f38193c50f
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2332 1720 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2340 wrote to memory of 1720 2340 rundll32.exe rundll32.exe PID 2340 wrote to memory of 1720 2340 rundll32.exe rundll32.exe PID 2340 wrote to memory of 1720 2340 rundll32.exe rundll32.exe PID 2340 wrote to memory of 1720 2340 rundll32.exe rundll32.exe PID 2340 wrote to memory of 1720 2340 rundll32.exe rundll32.exe PID 2340 wrote to memory of 1720 2340 rundll32.exe rundll32.exe PID 2340 wrote to memory of 1720 2340 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2332 1720 rundll32.exe WerFault.exe PID 1720 wrote to memory of 2332 1720 rundll32.exe WerFault.exe PID 1720 wrote to memory of 2332 1720 rundll32.exe WerFault.exe PID 1720 wrote to memory of 2332 1720 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2203⤵
- Program crash