Overview
overview
3Static
static
3湖南婚�...40.dll
windows7-x64
3湖南婚�...40.dll
windows10-2004-x64
3湖南婚姻/_bz2.dll
windows7-x64
1湖南婚姻/_bz2.dll
windows10-2004-x64
3湖南婚�...al.dll
windows7-x64
1湖南婚�...al.dll
windows10-2004-x64
3湖南婚�...ib.dll
windows7-x64
1湖南婚�...ib.dll
windows10-2004-x64
3湖南婚�...ma.dll
windows7-x64
1湖南婚�...ma.dll
windows10-2004-x64
3湖南婚�...ue.dll
windows7-x64
1湖南婚�...ue.dll
windows10-2004-x64
3湖南婚姻/_ssl.dll
windows7-x64
1湖南婚姻/_ssl.dll
windows10-2004-x64
1湖南婚�..._1.dll
windows7-x64
1湖南婚�..._1.dll
windows10-2004-x64
3湖南婚�..._1.dll
windows7-x64
1湖南婚�..._1.dll
windows10-2004-x64
1湖南婚�...t__.py
windows7-x64
3湖南婚�...t__.py
windows10-2004-x64
3湖南婚�...39.pyc
windows7-x64
3湖南婚�...39.pyc
windows10-2004-x64
3湖南婚�...me.dll
windows7-x64
1湖南婚�...me.dll
windows10-2004-x64
1湖南婚�...39.dll
windows7-x64
1湖南婚�...39.dll
windows10-2004-x64
3湖南婚�...ct.dll
windows7-x64
1湖南婚�...ct.dll
windows10-2004-x64
3湖南婚�...64.dll
windows7-x64
1湖南婚�...64.dll
windows10-2004-x64
1湖南婚�...ta.dll
windows7-x64
1湖南婚�...ta.dll
windows10-2004-x64
3Analysis
-
max time kernel
75s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
13-04-2023 02:38
Behavioral task
behavioral1
Sample
湖南婚姻/VCRUNTIME140.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
湖南婚姻/VCRUNTIME140.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
湖南婚姻/_bz2.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
湖南婚姻/_bz2.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
湖南婚姻/_decimal.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
湖南婚姻/_decimal.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
湖南婚姻/_hashlib.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
湖南婚姻/_hashlib.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral9
Sample
湖南婚姻/_lzma.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
湖南婚姻/_lzma.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
湖南婚姻/_queue.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
湖南婚姻/_queue.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
湖南婚姻/_ssl.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
湖南婚姻/_ssl.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
湖南婚姻/libcrypto-1_1.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
湖南婚姻/libcrypto-1_1.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral17
Sample
湖南婚姻/libssl-1_1.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
湖南婚姻/libssl-1_1.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
湖南婚姻/pyarmor_runtime_000000/__init__.py
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
湖南婚姻/pyarmor_runtime_000000/__init__.py
Resource
win10v2004-20230221-en
Behavioral task
behavioral21
Sample
湖南婚姻/pyarmor_runtime_000000/__pycache__/__init__.cpython-39.pyc
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
湖南婚姻/pyarmor_runtime_000000/__pycache__/__init__.cpython-39.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
湖南婚姻/pyarmor_runtime_000000/pyarmor_runtime.dll
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
湖南婚姻/pyarmor_runtime_000000/pyarmor_runtime.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
湖南婚姻/python39.dll
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
湖南婚姻/python39.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
湖南婚姻/select.dll
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
湖南婚姻/select.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
湖南婚姻/simplejson/_speedups.cp39-win_amd64.dll
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
湖南婚姻/simplejson/_speedups.cp39-win_amd64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
湖南婚姻/unicodedata.dll
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
湖南婚姻/unicodedata.dll
Resource
win10v2004-20230220-en
General
-
Target
湖南婚姻/_bz2.dll
-
Size
85KB
-
MD5
c013236b137b64ff2f30dc0c2af56084
-
SHA1
3d600c348794b3116c0d3230a40672be350142f7
-
SHA256
c435022d2cc868e26cde10e7749862ee8a177fced3289d49c3bc33af0c949d3f
-
SHA512
8fc14cafc32331af3f04257ea38d562d419c2c8c89ccaa8ace51593e708ec9cb27d9e1bd241bc717f929bd2d8c68aa78824af6b5adf1bde0e25812ec4de15852
-
SSDEEP
1536:D7Sz7efjsrb7QMpfQKeGPHMD6p4fr718EtABfx1iN3npFIztVGc7Syk:DeztXcUfAG/MD6pUr76Etax1iN3pFIzC
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 5104 1132 WerFault.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\湖南婚姻\_bz2.dll,#11⤵PID:1132
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1132 -s 3562⤵
- Program crash
PID:5104
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 368 -p 1132 -ip 11321⤵PID:2352