Overview
overview
10Static
static
3tempy/7zz.exe
windows7-x64
1tempy/7zz.exe
windows10-2004-x64
1tempy/ARCHIVE.bat
windows7-x64
1tempy/ARCHIVE.bat
windows10-2004-x64
1tempy/HTCTL32.dll
windows7-x64
3tempy/HTCTL32.dll
windows10-2004-x64
3tempy/NSM.lic
windows7-x64
tempy/NSM.lic
windows10-2004-x64
tempy/NSM.ini
windows7-x64
1tempy/NSM.ini
windows10-2004-x64
1tempy/PCICHEK.dll
windows7-x64
1tempy/PCICHEK.dll
windows10-2004-x64
5tempy/PCICL32.dll
windows7-x64
1tempy/PCICL32.dll
windows10-2004-x64
1tempy/TCCTL32.dll
windows7-x64
1tempy/TCCTL32.dll
windows10-2004-x64
1tempy/client32.exe
windows7-x64
10tempy/client32.exe
windows10-2004-x64
10tempy/client32.ini
windows7-x64
1tempy/client32.ini
windows10-2004-x64
1tempy/hints.txt
windows7-x64
1tempy/hints.txt
windows10-2004-x64
1tempy/msvcr100.dll
windows7-x64
3tempy/msvcr100.dll
windows10-2004-x64
3tempy/nskbfltr.inf
windows7-x64
1tempy/nskbfltr.inf
windows10-2004-x64
1tempy/nsm_vpro.ini
windows7-x64
1tempy/nsm_vpro.ini
windows10-2004-x64
1tempy/pcicapi.dll
windows7-x64
1tempy/pcicapi.dll
windows10-2004-x64
1tempy/putty.exe
windows7-x64
1tempy/putty.exe
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
14/07/2023, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
tempy/7zz.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
tempy/7zz.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
tempy/ARCHIVE.bat
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
tempy/ARCHIVE.bat
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
tempy/HTCTL32.dll
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
tempy/HTCTL32.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
tempy/NSM.lic
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
tempy/NSM.lic
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
tempy/NSM.ini
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
tempy/NSM.ini
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
tempy/PCICHEK.dll
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
tempy/PCICHEK.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
tempy/PCICL32.dll
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
tempy/PCICL32.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
tempy/TCCTL32.dll
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
tempy/TCCTL32.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
tempy/client32.exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
tempy/client32.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
tempy/client32.ini
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
tempy/client32.ini
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
tempy/hints.txt
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
tempy/hints.txt
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
tempy/msvcr100.dll
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
tempy/msvcr100.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
tempy/nskbfltr.inf
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
tempy/nskbfltr.inf
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
tempy/nsm_vpro.ini
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
tempy/nsm_vpro.ini
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
tempy/pcicapi.dll
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
tempy/pcicapi.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
tempy/putty.exe
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
tempy/putty.exe
Resource
win10v2004-20230703-en
General
-
Target
tempy/msvcr100.dll
-
Size
755KB
-
MD5
0e37fbfa79d349d672456923ec5fbbe3
-
SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
-
SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
-
SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
SSDEEP
12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2112 1576 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 688 wrote to memory of 1576 688 rundll32.exe 28 PID 688 wrote to memory of 1576 688 rundll32.exe 28 PID 688 wrote to memory of 1576 688 rundll32.exe 28 PID 688 wrote to memory of 1576 688 rundll32.exe 28 PID 688 wrote to memory of 1576 688 rundll32.exe 28 PID 688 wrote to memory of 1576 688 rundll32.exe 28 PID 688 wrote to memory of 1576 688 rundll32.exe 28 PID 1576 wrote to memory of 2112 1576 rundll32.exe 29 PID 1576 wrote to memory of 2112 1576 rundll32.exe 29 PID 1576 wrote to memory of 2112 1576 rundll32.exe 29 PID 1576 wrote to memory of 2112 1576 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tempy\msvcr100.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tempy\msvcr100.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 2243⤵
- Program crash
PID:2112
-
-