Overview
overview
8Static
static
3WOMicClien..._2.exe
windows10-1703-x64
WOMicClien..._2.exe
windows11-21h2-x64
7$PLUGINSDI...LL.dll
windows10-1703-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows10-1703-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3driver/devcon.exe
windows10-1703-x64
1driver/devcon.exe
windows11-21h2-x64
1Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 23:56
Static task
static1
Behavioral task
behavioral1
Sample
WOMicClientSetup5_2.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
WOMicClientSetup5_2.exe
Resource
win11-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10-20240611-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
driver/devcon.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
driver/devcon.exe
Resource
win11-20240508-en
General
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
d6c3dd680c6467d07d730255d0ee5d87
-
SHA1
57e7a1d142032652256291b8ed2703b3dc1dfa9b
-
SHA256
aedb5122c12037bcf5c79c2197d1474e759cf47c67c37cdb21cf27428854a55b
-
SHA512
c28613d6d91c1f1f7951116f114da1c49e5f4994c855e522930bb4a8bdd73f12cadf1c6dcb84fc8d9f983ec60a40ac39522d3f86695e17ec88da4bd91c7b6a51
-
SSDEEP
192:oWa8cSzvTyl4tgi8pPjQM0PuAg0YNyZIFtSP:DaBSzm+t18pZ0WAg0RZIFg
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 764 796 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 228 wrote to memory of 796 228 rundll32.exe rundll32.exe PID 228 wrote to memory of 796 228 rundll32.exe rundll32.exe PID 228 wrote to memory of 796 228 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 5443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 796 -ip 7961⤵