Overview
overview
10Static
static
1Additional...ks.dll
windows7-x64
1Additional...ks.dll
windows10-2004-x64
1Additional...ks.dll
windows7-x64
1Additional...ks.dll
windows10-2004-x64
1Additional...ks.dll
windows7-x64
1Additional...ks.dll
windows10-2004-x64
1Bin/Privacy.dll
windows7-x64
1Bin/Privacy.dll
windows10-2004-x64
1Bin/RulesAPI.dll
windows7-x64
3Bin/RulesAPI.dll
windows10-2004-x64
3Bin/Skin.dll
windows7-x64
3Bin/Skin.dll
windows10-2004-x64
3Bin/dbghelp.dll
windows7-x64
1Bin/dbghelp.dll
windows10-2004-x64
1Bin/dllhelper.dll
windows7-x64
1Bin/dllhelper.dll
windows10-2004-x64
1Bin/dllhelper64.dll
windows7-x64
1Bin/dllhelper64.dll
windows10-2004-x64
1Plugins/Ga...nt.dll
windows7-x64
1Plugins/Ga...nt.dll
windows10-2004-x64
1Plugins/sounds.dll
windows7-x64
3Plugins/sounds.dll
windows10-2004-x64
1Software.exe
windows7-x64
10Software.exe
windows10-2004-x64
10Analysis
-
max time kernel
24s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 13:38
Static task
static1
Behavioral task
behavioral1
Sample
Additional files/VisualStudio/v12.0/Microsoft.VisualStudio.PortableLibrary.Build.Tasks.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Additional files/VisualStudio/v12.0/Microsoft.VisualStudio.PortableLibrary.Build.Tasks.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Additional files/VisualStudio/v14.0/Microsoft.VisualStudio.PortableLibrary.Build.Tasks.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Additional files/VisualStudio/v14.0/Microsoft.VisualStudio.PortableLibrary.Build.Tasks.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Additional files/VisualStudio/v15.0/Microsoft.VisualStudio.PortableLibrary.Build.Tasks.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
Additional files/VisualStudio/v15.0/Microsoft.VisualStudio.PortableLibrary.Build.Tasks.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
Bin/Privacy.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Bin/Privacy.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Bin/RulesAPI.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
Bin/RulesAPI.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
Bin/Skin.dll
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
Bin/Skin.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
Bin/dbghelp.dll
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
Bin/dbghelp.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
Bin/dllhelper.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Bin/dllhelper.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Bin/dllhelper64.dll
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
Bin/dllhelper64.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
Plugins/GameClient.dll
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
Plugins/GameClient.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
Plugins/sounds.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
Plugins/sounds.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
Software.exe
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
Software.exe
Resource
win10v2004-20221111-en
General
-
Target
Bin/RulesAPI.dll
-
Size
2.1MB
-
MD5
0af80bfc69d7c3451c6d3b90d7313c8e
-
SHA1
e54e9830f6be8f024fd8a280c71107ff501fedbd
-
SHA256
d427297511cc0f637801aabbbe8a5a5526d1bf67cf15296839dbfeddc10f3edc
-
SHA512
5e4bb27c2686b9fb3f87f3afaa72250da67d07a4f00ae58279f064d848fd127a3be0ad4919b4f56a3618984cd3f331e48d05c923220e144d974c9073528d3c5c
-
SSDEEP
24576:zxBDa823oFojLiY7KKDt370HDnd9BiS9IgBxOUsFsu2td9TCZNw:dhsR/tO9oSyOOkMZN
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 932 1432 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1552 wrote to memory of 1432 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1432 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1432 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1432 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1432 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1432 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1432 1552 rundll32.exe rundll32.exe PID 1432 wrote to memory of 932 1432 rundll32.exe WerFault.exe PID 1432 wrote to memory of 932 1432 rundll32.exe WerFault.exe PID 1432 wrote to memory of 932 1432 rundll32.exe WerFault.exe PID 1432 wrote to memory of 932 1432 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\RulesAPI.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\RulesAPI.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 2963⤵
- Program crash