Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
pay09809988.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
pay09809988.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
jy2091qep.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
jy2091qep.dll
Resource
win10v2004-20240226-en
General
-
Target
jy2091qep.dll
-
Size
18KB
-
MD5
a393df2af4708ff2592687ff4ee343b9
-
SHA1
19b5212fc5dbd673f7e4f78c52b6c0ea33121d85
-
SHA256
eea2ac27c7db126176b9cbf245328c9acb06665995f1212cc28792304ca3f6f5
-
SHA512
b960e1ad593a17d94cacec2ef4e30c1b17b69469e3f1a0b26d992dce1ef697078a466bd1bde5779373bae6ff5b35c39a13f818c03c4a3a3eacda051b44ea0491
-
SSDEEP
384:WkZm9ZV/dm0q96GA2P0ICNPBRJyCmyCtQV2djVh2:WkZaZVd/qSkQHDlV2djV
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe 2464 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 840 wrote to memory of 2464 840 rundll32.exe rundll32.exe PID 840 wrote to memory of 2464 840 rundll32.exe rundll32.exe PID 840 wrote to memory of 2464 840 rundll32.exe rundll32.exe PID 840 wrote to memory of 2464 840 rundll32.exe rundll32.exe PID 840 wrote to memory of 2464 840 rundll32.exe rundll32.exe PID 840 wrote to memory of 2464 840 rundll32.exe rundll32.exe PID 840 wrote to memory of 2464 840 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jy2091qep.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jy2091qep.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses