Overview
overview
10Static
static
1python-3.1...er.dll
windows7-x64
1python-3.1...er.dll
windows10-2004-x64
3python-3.1...al.dll
windows7-x64
1python-3.1...al.dll
windows10-2004-x64
3python-3.1...er.dll
windows7-x64
1python-3.1...er.dll
windows10-2004-x64
3python-3.1...er.dll
windows7-x64
1python-3.1...er.dll
windows10-2004-x64
1python-3.1...nt.dll
windows7-x64
1python-3.1...nt.dll
windows10-2004-x64
1python-3.1...re.dll
windows7-x64
1python-3.1...re.dll
windows10-2004-x64
1python-3.1...es.dll
windows7-x64
1python-3.1...es.dll
windows10-2004-x64
1python-3.1...tl.dll
windows7-x64
1python-3.1...tl.dll
windows10-2004-x64
1python-3.1...nt.dll
windows7-x64
1python-3.1...nt.dll
windows10-2004-x64
1python-3.1...up.dll
windows7-x64
1python-3.1...up.dll
windows10-2004-x64
1python-3.1...re.dll
windows7-x64
1python-3.1...re.dll
windows10-2004-x64
7python-3.1...er.dll
windows7-x64
1python-3.1...er.dll
windows10-2004-x64
1python-3.1...er.dll
windows7-x64
1python-3.1...er.dll
windows10-2004-x64
1python-3.1...64.exe
windows7-x64
10python-3.1...64.exe
windows10-2004-x64
10Analysis
-
max time kernel
84s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2023 14:25
Static task
static1
Behavioral task
behavioral1
Sample
python-3.11.2-amd64/pres/fr/FaceBootstrapAdapter.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
python-3.11.2-amd64/pres/fr/FaceBootstrapAdapter.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
python-3.11.2-amd64/pres/fr/FaceTrackerInternal.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
python-3.11.2-amd64/pres/fr/FaceTrackerInternal.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
python-3.11.2-amd64/pres/fr/docs/perf/MapRouter.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
python-3.11.2-amd64/pres/fr/docs/perf/MapRouter.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
python-3.11.2-amd64/pres/fr/docs/perf/XblAuthManager.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
python-3.11.2-amd64/pres/fr/docs/perf/XblAuthManager.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
python-3.11.2-amd64/pres/fr/docs/perf/XpsPrint.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
python-3.11.2-amd64/pres/fr/docs/perf/XpsPrint.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
python-3.11.2-amd64/pres/fr/docs/perf/migstore.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
python-3.11.2-amd64/pres/fr/docs/perf/migstore.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
python-3.11.2-amd64/pres/fr/docs/perf/xpsservices.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
python-3.11.2-amd64/pres/fr/docs/perf/xpsservices.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
python-3.11.2-amd64/pres/fr/dons/mig/msv/MSVidCtl.dll
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
python-3.11.2-amd64/pres/fr/dons/mig/msv/MSVidCtl.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
python-3.11.2-amd64/pres/fr/dons/mig/msv/XpsPrint.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
python-3.11.2-amd64/pres/fr/dons/mig/msv/XpsPrint.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
python-3.11.2-amd64/pres/fr/dons/mig/msv/winsetup.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
python-3.11.2-amd64/pres/fr/dons/mig/msv/winsetup.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
python-3.11.2-amd64/pres/fr/wbemcore.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
python-3.11.2-amd64/pres/fr/wbemcore.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
python-3.11.2-amd64/pres/ind/app/ProvProvider.dll
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
python-3.11.2-amd64/pres/ind/app/ProvProvider.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
python-3.11.2-amd64/pres/ind/app/TransmogProvider.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
python-3.11.2-amd64/pres/ind/app/TransmogProvider.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
python-3.11.2-amd64/python-3.11.2-amd64.exe
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
python-3.11.2-amd64/python-3.11.2-amd64.exe
Resource
win10v2004-20220812-en
General
-
Target
python-3.11.2-amd64/pres/fr/docs/perf/MapRouter.dll
-
Size
3.0MB
-
MD5
ed462036b7ec9d6d9d668f0f51443319
-
SHA1
1a0bc32ca9dd5b1451355e7733aecb330ece7a58
-
SHA256
81f1badd9345f296ae34809bc745ca4dfcde1def0dfd317076d5340981b5fb94
-
SHA512
b5f9efcab8686c439880af06d5b0d59da77b7f1fba72bdd97b5645b6bd0761ec069bbaf0d581837c939b7ce5765728210130d6c91c511be61b94267352f5c589
-
SSDEEP
49152:ZsffgkQDokXgBtPrrI8+yna8hSWvy9N4m7Zgygb22Bdxs63mkdV2z4ju7GKARnPM:VtwWzJ2BHtvn6Z
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1888 4148 WerFault.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\python-3.11.2-amd64\pres\fr\docs\perf\MapRouter.dll,#11⤵PID:4148
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4148 -s 3882⤵
- Program crash
PID:1888
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 360 -p 4148 -ip 41481⤵PID:2116