Overview
overview
3Static
static
3SA_-_Wides...Fix.7z
windows7-x64
3SA_-_Wides...Fix.7z
windows10-2004-x64
3Leiame (ou morra).txt
windows7-x64
1Leiame (ou morra).txt
windows10-2004-x64
1Readme (or die).txt
windows7-x64
1Readme (or die).txt
windows10-2004-x64
1Widescreen...ix.dll
windows7-x64
1Widescreen...ix.dll
windows10-2004-x64
3Widescreen...ix.ini
windows7-x64
1Widescreen...ix.ini
windows10-2004-x64
1Widescreen...a).txt
windows7-x64
1Widescreen...a).txt
windows10-2004-x64
1Widescreen...e).txt
windows7-x64
1Widescreen...e).txt
windows10-2004-x64
1Widescreen...a).txt
windows7-x64
1Widescreen...a).txt
windows10-2004-x64
1Widescreen...e).txt
windows7-x64
1Widescreen...e).txt
windows10-2004-x64
1Widescreen...ps.dll
windows7-x64
1Widescreen...ps.dll
windows10-2004-x64
3Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02/05/2023, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
SA_-_Widescreen_Fix.7z
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SA_-_Widescreen_Fix.7z
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
Leiame (ou morra).txt
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Leiame (ou morra).txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Readme (or die).txt
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Readme (or die).txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Widescreen Fix by ThirteenAG/GTASA.WidescreenFix.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Widescreen Fix by ThirteenAG/GTASA.WidescreenFix.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Widescreen Fix by ThirteenAG/GTASA.WidescreenFix.ini
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Widescreen Fix by ThirteenAG/GTASA.WidescreenFix.ini
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Widescreen Fix by ThirteenAG/Leiame (ou morra).txt
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Widescreen Fix by ThirteenAG/Leiame (ou morra).txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Widescreen Fix by ThirteenAG/Readme (or die).txt
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Widescreen Fix by ThirteenAG/Readme (or die).txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Widescreen HOR+ Support by Wesser/Leiame (ou morra).txt
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Widescreen HOR+ Support by Wesser/Leiame (ou morra).txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Widescreen HOR+ Support by Wesser/Readme (or die).txt
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Widescreen HOR+ Support by Wesser/Readme (or die).txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Widescreen HOR+ Support by Wesser/wshps.dll
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Widescreen HOR+ Support by Wesser/wshps.dll
Resource
win10v2004-20230221-en
General
-
Target
Widescreen Fix by ThirteenAG/GTASA.WidescreenFix.dll
-
Size
317KB
-
MD5
c64d4e7062adcc8a34a52ad5b7926ce9
-
SHA1
8f14ee24468511baaf009b24e6c3b95e3eab3673
-
SHA256
4a5394f92c45fce7cf6337b7f5c3299db048d35a1632c2a11ee816e2cf016755
-
SHA512
797a000a388cbc114b091e90090f1438082916993793735489ec81f187f5260f29f20c53ebda05cd06b1a903d3f0df6acd99382d92d5d0800b92e13504685c5a
-
SSDEEP
3072:y4UkREAzLVPiBT/dnl695c7Q49xRGOR66qf56LYeFNq0I9jwHRKLk1ZNH9WXm55:x2AzL+69ak4/EOg7ovAqxijAOdIWaQQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1728 1196 rundll32.exe 28 PID 1196 wrote to memory of 1728 1196 rundll32.exe 28 PID 1196 wrote to memory of 1728 1196 rundll32.exe 28 PID 1196 wrote to memory of 1728 1196 rundll32.exe 28 PID 1196 wrote to memory of 1728 1196 rundll32.exe 28 PID 1196 wrote to memory of 1728 1196 rundll32.exe 28 PID 1196 wrote to memory of 1728 1196 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Widescreen Fix by ThirteenAG\GTASA.WidescreenFix.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Widescreen Fix by ThirteenAG\GTASA.WidescreenFix.dll",#12⤵PID:1728
-