Overview
overview
7Static
static
3PH2FI.rar
windows7-x64
3PH2FI.rar
windows10-2004-x64
7PH2FI/Desc...og.url
windows7-x64
PH2FI/Desc...og.url
windows10-2004-x64
1PH2FI/Perf...og.url
windows7-x64
1PH2FI/Perf...og.url
windows10-2004-x64
1PH2FI/Perf...lp.dll
windows7-x64
1PH2FI/Perf...lp.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1PH2FI/Perf...in.dll
windows7-x64
1PH2FI/Perf...in.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1PH2FI/Perf...pi.dll
windows7-x64
1PH2FI/Perf...pi.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1PH2FI/Perf...64.dll
windows7-x64
1PH2FI/Perf...64.dll
windows10-2004-x64
1Analysis
-
max time kernel
124s -
max time network
320s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 21:09
Static task
static1
Behavioral task
behavioral1
Sample
PH2FI.rar
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
PH2FI.rar
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
PH2FI/Descarga JUEGOS GRATIS - PiviGames.blog.url
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
PH2FI/Descarga JUEGOS GRATIS - PiviGames.blog.url
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
PH2FI/Perfect Heist 2/Descarga JUEGOS GRATIS - PiviGames.blog.url
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
PH2FI/Perfect Heist 2/Descarga JUEGOS GRATIS - PiviGames.blog.url
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/DbgHelp/dbghelp.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/DbgHelp/dbghelp.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/Oculus/OVRPlugin/OVRPlugin/Win64/OVRPlugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/Oculus/OVRPlugin/OVRPlugin/Win64/OVRPlugin.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/OpenVR/OpenVRv1_5_17/Win64/openvr_api.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/OpenVR/OpenVRv1_5_17/Win64/openvr_api.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_ClothingPROFILE_x64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_ClothingPROFILE_x64.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_Clothing_x64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_Clothing_x64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_DestructiblePROFILE_x64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_DestructiblePROFILE_x64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_Destructible_x64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_Destructible_x64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_LegacyPROFILE_x64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_LegacyPROFILE_x64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_Legacy_x64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/APEX_Legacy_x64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/ApexFrameworkPROFILE_x64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/ApexFrameworkPROFILE_x64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/ApexFramework_x64.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral32
Sample
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/ApexFramework_x64.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
PH2FI/Perfect Heist 2/Engine/Binaries/ThirdParty/PhysX3/Win64/VS2015/ApexFrameworkPROFILE_x64.dll
-
Size
1.3MB
-
MD5
05850a0b6d50309a5a5c99f49dcf81ab
-
SHA1
d9e9941f0358c6b7e483c45e61fcdf80211ba7ef
-
SHA256
243e4b82d84f6abfc400aaa8c2cc4fc93f36e670c016bc673f18569eb04d47ec
-
SHA512
197ccfd269fa1bc7c6a85f7d9e11ef7345d24001c13654fc020dd994a34336664ea0b0560f196e8b812c75b6ebea295ae1f68997e8d812e78ee12f9889707106
-
SSDEEP
12288:BBrkSKdSToG/YCo44sxelj8qFOteqLjp+Hr7XUal:USKEzurQelj8Ltemjp+Hr7p
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1788 wrote to memory of 300 1788 rundll32.exe 26 PID 1788 wrote to memory of 300 1788 rundll32.exe 26 PID 1788 wrote to memory of 300 1788 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\PH2FI\Perfect Heist 2\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\ApexFrameworkPROFILE_x64.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1788 -s 842⤵PID:300
-