Overview
overview
7Static
static
1PvZ_Tools_....3.exe
windows10-2004-x64
1PvZ_Tools_...xe.asc
windows10-2004-x64
3PvZ_Tools_...e.hash
windows10-2004-x64
3PvZ_Tools_...re.dll
windows10-2004-x64
3PvZ_Tools_...ui.dll
windows10-2004-x64
1PvZ_Tools_...rk.dll
windows10-2004-x64
3PvZ_Tools_...ts.dll
windows10-2004-x64
3PvZ_Tools_...er.dll
windows10-2004-x64
1PvZ_Tools_...if.dll
windows10-2004-x64
1PvZ_Tools_...co.dll
windows10-2004-x64
1PvZ_Tools_...eg.dll
windows10-2004-x64
1PvZ_Tools_..._1.dll
windows10-2004-x64
3PvZ_Tools_..._1.dll
windows10-2004-x64
1PvZ_Tools_...g.json
windows10-2004-x64
3PvZ_Tools_...ws.dll
windows10-2004-x64
1PvZ_Tools_...sh.jpg
windows10-2004-x64
3PvZ_Tools_...le.dll
windows10-2004-x64
1PvZ_Tools_...86.exe
windows10-2004-x64
7PvZ_Tools_...b1.dll
windows10-2004-x64
3PvZ_Tools_...pt.url
windows10-2004-x64
1PvZ_Tools_...X1.der
windows10-2004-x64
1PvZ_Tools_...X2.der
windows10-2004-x64
1PvZ_Tools_...es.url
windows10-2004-x64
1PvZ_Tools_...it.url
windows10-2004-x64
1PvZ_Tools_...ds.url
windows10-2004-x64
1Analysis
-
max time kernel
294s -
max time network
298s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2023, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe.asc
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe.hash
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
PvZ_Tools_v2.7.3/Qt5Core.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
PvZ_Tools_v2.7.3/Qt5Gui.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
PvZ_Tools_v2.7.3/Qt5Network.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
PvZ_Tools_v2.7.3/Qt5Widgets.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
PvZ_Tools_v2.7.3/bearer/qgenericbearer.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
PvZ_Tools_v2.7.3/imageformats/qgif.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral10
Sample
PvZ_Tools_v2.7.3/imageformats/qico.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
PvZ_Tools_v2.7.3/imageformats/qjpeg.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
PvZ_Tools_v2.7.3/libcrypto-1_1.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
PvZ_Tools_v2.7.3/libssl-1_1.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
PvZ_Tools_v2.7.3/lineup_string.json
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
PvZ_Tools_v2.7.3/platforms/qwindows.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
PvZ_Tools_v2.7.3/splash.jpg
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
PvZ_Tools_v2.7.3/styles/qwindowsvistastyle.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
PvZ_Tools_v2.7.3/vc_redist.x86.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
PvZ_Tools_v2.7.3/zlib1.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral20
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/HTTPS 根证书/Chain of Trust - Let's Encrypt.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/HTTPS 根证书/ISRG Root X1.der
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/HTTPS 根证书/ISRG Root X2.der
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/下载游戏 Plants vs. Zombies.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/下载辅助 PvZ Toolkit.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/阵型列表 Endless Builds.url
Resource
win10v2004-20230221-en
General
-
Target
PvZ_Tools_v2.7.3/Qt5Gui.dll
-
Size
4.5MB
-
MD5
744cc7de06ac25c2b7ef4117bd9d99fe
-
SHA1
8c81cb46987c5b0333557019057429d1e5ba9487
-
SHA256
1a632df920a31e8334233f67002cd34f31751e0808c11f236c03f2d10f671533
-
SHA512
743e5027db4154596e4d5f63ebaa6d7469e8116819cdffdd6456c9af4c60c1ff00e389cd1ab94abf407247e9cf985fee8a25a99a1d524a0fb8bd3881c7e74f20
-
SSDEEP
98304:0X9YxZyh9nPpMSX585WX6rDPoZIiaiE8Tqw:8rXPpMa585WX63PAIT78W
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1224 wrote to memory of 4224 1224 rundll32.exe 81 PID 1224 wrote to memory of 4224 1224 rundll32.exe 81 PID 1224 wrote to memory of 4224 1224 rundll32.exe 81