cd660bd4d4f7d33920a2c18be331041ba80d7770e1c47153a5dfae6da3f5e43e

Submit
Reports

Overview

overview

Static

static

Crafty-v1....rp.dll

windows10-2004-x64

Crafty-v1.1/Splat.dll

windows10-2004-x64

Crafty-v1....on.dll

windows10-2004-x64

Crafty-v1....es.dll

windows10-2004-x64

Crafty-v1....ve.dll

windows10-2004-x64

Crafty-v1....ta.dll

windows10-2004-x64

Crafty-v1....ol.dll

windows10-2004-x64

Crafty-v1....et.dll

windows10-2004-x64

Crafty-v1....arp.so

windows10-2004-x64

Crafty-v1....arp.so

windows10-2004-x64

Crafty-v1....arp.so

windows10-2004-x64

Crafty-v1....arp.so

windows10-2004-x64

Crafty-v1....arp.so

windows10-2004-x64

Crafty-v1....arp.so

windows10-2004-x64

Crafty-v1....arp.so

windows10-2004-x64

Crafty-v1....arp.so

windows10-2004-x64

Crafty-v1.....dylib

windows10-2004-x64

Crafty-v1.....dylib

windows10-2004-x64

Crafty-v1.....dylib

windows10-2004-x64

Crafty-v1....on.dll

windows10-2004-x64

Crafty-v1....v2.dll

windows10-2004-x64

Crafty-v1....rp.dll

windows10-2004-x64

Crafty-v1....rp.dll

windows10-2004-x64

Crafty-v1....v2.dll

windows10-2004-x64

Crafty-v1....rp.dll

windows10-2004-x64

Crafty-v1....rp.dll

windows10-2004-x64

Crafty-v1....v2.dll

windows10-2004-x64

Crafty-v1....rp.dll

windows10-2004-x64

Crafty-v1....rp.dll

windows10-2004-x64

Crafty-v1....ts.dll

windows10-2004-x64

Crafty-v1....on.dll

windows10-2004-x64

Crafty-v1....ta.dll

windows10-2004-x64

Analysis

max time kernel
112s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15-06-2023 05:33

Sharing

Copy URL

Twitter E-mail

Static task

static1

coreentity

2 signatures

Behavioral task

behavioral1

Sample

Crafty-v1.1/SkiaSharp.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral2

Sample

Crafty-v1.1/Splat.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral3

Sample

Crafty-v1.1/System.Drawing.Common.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral4

Sample

Crafty-v1.1/System.IO.Pipelines.dll

Resource

win10v2004-20230221-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral5

Sample

Crafty-v1.1/System.Reactive.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral6

Sample

Crafty-v1.1/System.Security.Cryptography.ProtectedData.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral7

Sample

Crafty-v1.1/Tmds.DBus.Protocol.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral8

Sample

Crafty-v1.1/XboxAuthNet.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral9

Sample

Crafty-v1.1/runtimes/linux-arm/native/libHarfBuzzSharp.so

Resource

win10v2004-20230220-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral10

Sample

Crafty-v1.1/runtimes/linux-arm/native/libSkiaSharp.so

Resource

win10v2004-20230220-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral11

Sample

Crafty-v1.1/runtimes/linux-arm64/native/libHarfBuzzSharp.so

Resource

win10v2004-20230220-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral12

Sample

Crafty-v1.1/runtimes/linux-arm64/native/libSkiaSharp.so

Resource

win10v2004-20230220-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral13

Sample

Crafty-v1.1/runtimes/linux-musl-x64/native/libHarfBuzzSharp.so

Resource

win10v2004-20230220-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral14

Sample

Crafty-v1.1/runtimes/linux-musl-x64/native/libSkiaSharp.so

Resource

win10v2004-20230221-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral15

Sample

Crafty-v1.1/runtimes/linux-x64/native/libHarfBuzzSharp.so

Resource

win10v2004-20230220-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral16

Sample

Crafty-v1.1/runtimes/linux-x64/native/libSkiaSharp.so

Resource

win10v2004-20230220-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral17

Sample

Crafty-v1.1/runtimes/osx/native/libAvaloniaNative.dylib

Resource

win10v2004-20230220-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral18

Sample

Crafty-v1.1/runtimes/osx/native/libHarfBuzzSharp.dylib

Resource

win10v2004-20230221-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral19

Sample

Crafty-v1.1/runtimes/osx/native/libSkiaSharp.dylib

Resource

win10v2004-20230220-es

windows10-2004-x64

3 signatures

120 seconds

Behavioral task

behavioral20

Sample

Crafty-v1.1/runtimes/unix/lib/net6.0/System.Drawing.Common.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral21

Sample

Crafty-v1.1/runtimes/win-arm64/native/av_libglesv2.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral22

Sample

Crafty-v1.1/runtimes/win-arm64/native/libHarfBuzzSharp.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral23

Sample

Crafty-v1.1/runtimes/win-arm64/native/libSkiaSharp.dll

Resource

win10v2004-20230221-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral24

Sample

Crafty-v1.1/runtimes/win-x64/native/av_libglesv2.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

1 signatures

120 seconds

Behavioral task

behavioral25

Sample

Crafty-v1.1/runtimes/win-x64/native/libHarfBuzzSharp.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

1 signatures

120 seconds

Behavioral task

behavioral26

Sample

Crafty-v1.1/runtimes/win-x64/native/libSkiaSharp.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral27

Sample

Crafty-v1.1/runtimes/win-x86/native/av_libglesv2.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

2 signatures

120 seconds

Behavioral task

behavioral28

Sample

Crafty-v1.1/runtimes/win-x86/native/libHarfBuzzSharp.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

2 signatures

120 seconds

Behavioral task

behavioral29

Sample

Crafty-v1.1/runtimes/win-x86/native/libSkiaSharp.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

1 signatures

120 seconds

Behavioral task

behavioral30

Sample

Crafty-v1.1/runtimes/win/lib/net6.0/Microsoft.Win32.SystemEvents.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral31

Sample

Crafty-v1.1/runtimes/win/lib/net6.0/System.Drawing.Common.dll

Resource

win10v2004-20230221-es

windows10-2004-x64

0 signatures

120 seconds

Behavioral task

behavioral32

Sample

Crafty-v1.1/runtimes/win/lib/netstandard2.0/System.Security.Cryptography.ProtectedData.dll

Resource

win10v2004-20230220-es

windows10-2004-x64

0 signatures

120 seconds

Report Analysis Logs

General

Target

Crafty-v1.1/runtimes/win-x86/native/libSkiaSharp.dll
Size

7.6MB
MD5

19bf278d367828df1322034e3d394b2a
SHA1

874d730207bd418a003564b3c75dad0f17116330
SHA256

4c8f7fa7c4181ee9e78f3a19966fa7a3f9731daad49ff366eefb321a2d5a9992
SHA512

b32cc97aa3b6cda90a94eee2f68aa734db26e8a310cf83f237f484dc2c6ec997790a56ac5c5d6fc63c8825163ab6b5c6ed2e34ef96bb30bdd51ce7bf21fcedef
SSDEEP

98304:eKEkacEtTh7mGlqR5i8w0nJG8uh9KCBJqps7i:LacuVjlO5i8FG8ElBJqyi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 4240	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 4240	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 4240	2040	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Crafty-v1.1\runtimes\win-x86\native\libSkiaSharp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Crafty-v1.1\runtimes\win-x86\native\libSkiaSharp.dll,#1
2⤵
PID:4240

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads