Overview
overview
3Static
static
元神电�...to.dll
windows7-x64
1元神电�...to.dll
windows10-2004-x64
1元神电�...ib.dll
windows7-x64
1元神电�...ib.dll
windows10-2004-x64
1元神电�...vm.dll
windows7-x64
1元神电�...vm.dll
windows10-2004-x64
1元神电�...er.exe
windows7-x64
3元神电�...er.exe
windows10-2004-x64
3元神电�...ib.dll
windows7-x64
3元神电�...ib.dll
windows10-2004-x64
3元神电�...on.dll
windows7-x64
1元神电�...on.dll
windows10-2004-x64
1元神电�...UI.dll
windows7-x64
1元神电�...UI.dll
windows10-2004-x64
1元神电�...PF.dll
windows7-x64
1元神电�...PF.dll
windows10-2004-x64
1元神电�...QQ.xml
windows7-x64
1元神电�...QQ.xml
windows10-2004-x64
1元神电�...rd.xml
windows7-x64
1元神电�...rd.xml
windows10-2004-x64
1元神电�...ub.xml
windows7-x64
1元神电�...ub.xml
windows10-2004-x64
1元神电�...pf.dll
windows7-x64
1元神电�...pf.dll
windows10-2004-x64
1元神电�...re.dll
windows7-x64
1元神电�...re.dll
windows10-2004-x64
1元神电�...ss.dll
windows7-x64
1元神电�...ss.dll
windows10-2004-x64
1元神电�...om.dll
windows7-x64
1元神电�...om.dll
windows10-2004-x64
1元神电�...el.dll
windows7-x64
1元神电�...el.dll
windows10-2004-x64
1Analysis
-
max time kernel
87s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 23:36
Static task
static1
Behavioral task
behavioral1
Sample
元神电脑教程/原神电脑启动器3.1版本/BouncyCastle.Crypto.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
元神电脑教程/原神电脑启动器3.1版本/BouncyCastle.Crypto.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
元神电脑教程/原神电脑启动器3.1版本/BrotliSharpLib.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
元神电脑教程/原神电脑启动器3.1版本/BrotliSharpLib.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
元神电脑教程/原神电脑启动器3.1版本/CommunityToolkit.Mvvm.dll
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
元神电脑教程/原神电脑启动器3.1版本/CommunityToolkit.Mvvm.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
元神电脑教程/原神电脑启动器3.1版本/Launcher.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
元神电脑教程/原神电脑启动器3.1版本/Launcher.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
元神电脑教程/原神电脑启动器3.1版本/MetadataConverterLib.dll
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
元神电脑教程/原神电脑启动器3.1版本/MetadataConverterLib.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
元神电脑教程/原神电脑启动器3.1版本/Newtonsoft.Json.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
元神电脑教程/原神电脑启动器3.1版本/Newtonsoft.Json.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
元神电脑教程/原神电脑启动器3.1版本/Panuon.WPF.UI.dll
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
元神电脑教程/原神电脑启动器3.1版本/Panuon.WPF.UI.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
元神电脑教程/原神电脑启动器3.1版本/Panuon.WPF.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
元神电脑教程/原神电脑启动器3.1版本/Panuon.WPF.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/QQ.xml
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/QQ.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/discord.xml
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/discord.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/github.xml
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/github.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Converters.Wpf.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Converters.Wpf.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Core.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Core.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Css.dll
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Css.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Dom.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Dom.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Model.dll
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Model.dll
Resource
win10v2004-20220812-en
General
-
Target
元神电脑教程/原神电脑启动器3.1版本/MetadataConverterLib.dll
-
Size
23KB
-
MD5
a8fbef2bcdd2092aae2b7ba3dcfcb894
-
SHA1
7c019efe205aa70d5693af3fed84339213700fa8
-
SHA256
aec9af70f889738d4edc5fad7d6c447efaa74598e163e6b3c17d7e8b699e2a4c
-
SHA512
db5e5b105691be930b0fba9d0c3b0f209f59ebd43f9d8f2585d962d9e1757917999cea12870aa63a4b97398d32bc4306aff6b27512382ad4c80af3bd6700f25d
-
SSDEEP
384:pZhMV9CX5Ph6CcauSi487++U0LZID4bMkD8dt:pAV2Pykx87YcID4okYdt
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 888 4804 WerFault.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\元神电脑教程\原神电脑启动器3.1版本\MetadataConverterLib.dll,#11⤵PID:4804
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4804 -s 3322⤵
- Program crash
PID:888
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4804 -ip 48041⤵PID:3544