Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
pay09809988.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
pay09809988.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
jy2091qep.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
jy2091qep.dll
Resource
win10v2004-20240226-en
General
-
Target
jy2091qep.dll
-
Size
18KB
-
MD5
a393df2af4708ff2592687ff4ee343b9
-
SHA1
19b5212fc5dbd673f7e4f78c52b6c0ea33121d85
-
SHA256
eea2ac27c7db126176b9cbf245328c9acb06665995f1212cc28792304ca3f6f5
-
SHA512
b960e1ad593a17d94cacec2ef4e30c1b17b69469e3f1a0b26d992dce1ef697078a466bd1bde5779373bae6ff5b35c39a13f818c03c4a3a3eacda051b44ea0491
-
SSDEEP
384:WkZm9ZV/dm0q96GA2P0ICNPBRJyCmyCtQV2djVh2:WkZaZVd/qSkQHDlV2djV
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2488 4184 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rundll32.exepid process 4184 rundll32.exe 4184 rundll32.exe 4184 rundll32.exe 4184 rundll32.exe 4184 rundll32.exe 4184 rundll32.exe 4184 rundll32.exe 4184 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4052 wrote to memory of 4184 4052 rundll32.exe rundll32.exe PID 4052 wrote to memory of 4184 4052 rundll32.exe rundll32.exe PID 4052 wrote to memory of 4184 4052 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jy2091qep.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jy2091qep.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 7403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4184 -ip 41841⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵