Overview
overview
9Static
static
9旺旺群�...EL.dll
windows7-x64
8旺旺群�...EL.dll
windows10-2004-x64
8旺旺群�...bh.dll
windows7-x64
1旺旺群�...bh.dll
windows10-2004-x64
1旺旺群�...le.dll
windows7-x64
1旺旺群�...le.dll
windows10-2004-x64
3旺旺群�...��.url
windows7-x64
1旺旺群�...��.url
windows10-2004-x64
1旺旺群�....0.exe
windows7-x64
8旺旺群�....0.exe
windows10-2004-x64
8旺旺群�...ch.exe
windows7-x64
1旺旺群�...ch.exe
windows10-2004-x64
1旺旺群�...��.doc
windows7-x64
4旺旺群�...��.doc
windows10-2004-x64
1最牛的�...��.url
windows7-x64
1最牛的�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
5s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 16:40
Behavioral task
behavioral1
Sample
旺旺群发E客服版/SkinH_EL.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
旺旺群发E客服版/SkinH_EL.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
旺旺群发E客服版/dxwl_bh.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
旺旺群发E客服版/dxwl_bh.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
旺旺群发E客服版/handle.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
旺旺群发E客服版/handle.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
旺旺群发E客服版/安装前必看.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
旺旺群发E客服版/安装前必看.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
旺旺群发E客服版/旺旺群发E客服版V1.0.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
旺旺群发E客服版/旺旺群发E客服版V1.0.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
旺旺群发E客服版/旺旺群发E客服版V1.0_Patch.exe
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
旺旺群发E客服版/旺旺群发E客服版V1.0_Patch.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
旺旺群发E客服版/群发帮助说明.doc
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
旺旺群发E客服版/群发帮助说明.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
最牛的单机游戏下载网站.url
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
最牛的单机游戏下载网站.url
Resource
win10v2004-20220812-en
General
-
Target
旺旺群发E客服版/SkinH_EL.dll
-
Size
86KB
-
MD5
147127382e001f495d1842ee7a9e7912
-
SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
-
SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
-
SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d
-
SSDEEP
1536:s5Np2dgZgIehUUS3E1Ujmrvl179D53UWnGQRJZiXRmrCnKptnouy8K:s5Np2dlUX0+Cx17F8QRJZKmOK3outK
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1380-56-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1344 1380 WerFault.exe rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 1380 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1180 wrote to memory of 1380 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1380 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1380 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1380 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1380 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1380 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1380 1180 rundll32.exe rundll32.exe PID 1380 wrote to memory of 1344 1380 rundll32.exe WerFault.exe PID 1380 wrote to memory of 1344 1380 rundll32.exe WerFault.exe PID 1380 wrote to memory of 1344 1380 rundll32.exe WerFault.exe PID 1380 wrote to memory of 1344 1380 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\旺旺群发E客服版\SkinH_EL.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\旺旺群发E客服版\SkinH_EL.dll,#12⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 2523⤵
- Program crash