Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10funni game...up.exe
windows11-21h2-x64
7funni game...up.exe
windows11-21h2-x64
7funni game...st.exe
windows11-21h2-x64
funni game...64.exe
windows11-21h2-x64
7funni game...86.exe
windows11-21h2-x64
7funni game...64.exe
windows11-21h2-x64
7funni game...86.exe
windows11-21h2-x64
7funni game...st.msi
windows11-21h2-x64
6funni game...er.dll
windows11-21h2-x64
1funni game...gc.dll
windows11-21h2-x64
1funni game...tor.js
windows11-21h2-x64
1funni game...tor.js
windows11-21h2-x64
1funni game...tor.js
windows11-21h2-x64
1funni game...64.exe
windows11-21h2-x64
1funni game...er.dll
windows11-21h2-x64
1funni game...no.dll
windows11-21h2-x64
1funni game...me.dll
windows11-21h2-x64
1funni game...me.exe
windows11-21h2-x64
7Analysis
-
max time kernel
84s -
max time network
91s -
platform
windows11-21h2_x64 -
resource
win11-20231222-en -
resource tags
arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system -
submitted
23/01/2024, 11:58
Behavioral task
behavioral1
Sample
funni game/_Redist/dotNetFx40_Full_setup.exe
Resource
win11-20231215-en
Behavioral task
behavioral2
Sample
funni game/_Redist/dxwebsetup.exe
Resource
win11-20231215-en
Behavioral task
behavioral3
Sample
funni game/_Redist/oalinst.exe
Resource
win11-20231215-en
Behavioral task
behavioral4
Sample
funni game/_Redist/vcredist_2015-2019_x64.exe
Resource
win11-20231215-en
Behavioral task
behavioral5
Sample
funni game/_Redist/vcredist_2015-2019_x86.exe
Resource
win11-20231222-en
Behavioral task
behavioral6
Sample
funni game/_Redist/vcredist_x64.exe
Resource
win11-20231215-en
Behavioral task
behavioral7
Sample
funni game/_Redist/vcredist_x86.exe
Resource
win11-20231222-en
Behavioral task
behavioral8
Sample
funni game/_Redist/xnafx40_redist.msi
Resource
win11-20231215-en
Behavioral task
behavioral9
Sample
funni game/money/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
Resource
win11-20231215-en
Behavioral task
behavioral10
Sample
funni game/money/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
Resource
win11-20231215-en
Behavioral task
behavioral11
Sample
funni game/money/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.js
Resource
win11-20231215-en
Behavioral task
behavioral12
Sample
funni game/money/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.js
Resource
win11-20231215-en
Behavioral task
behavioral13
Sample
funni game/money/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.js
Resource
win11-20231215-en
Behavioral task
behavioral14
Sample
funni game/money/UnityCrashHandler64.exe
Resource
win11-20231215-en
Behavioral task
behavioral15
Sample
funni game/money/UnityPlayer.dll
Resource
win11-20231215-en
Behavioral task
behavioral16
Sample
funni game/money/VclStylesinno.dll
Resource
win11-20231222-en
Behavioral task
behavioral17
Sample
funni game/money/WinPixEventRuntime.dll
Resource
win11-20231215-en
General
-
Target
funni game/money/VclStylesinno.dll
-
Size
3.0MB
-
MD5
b0ca93ceb050a2feff0b19e65072bbb5
-
SHA1
7ebbbbe2d2acd8fd516f824338d254a33b69f08d
-
SHA256
0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
-
SHA512
37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
SSDEEP
49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1916 wrote to memory of 4348 1916 rundll32.exe 79 PID 1916 wrote to memory of 4348 1916 rundll32.exe 79 PID 1916 wrote to memory of 4348 1916 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\funni game\money\VclStylesinno.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\funni game\money\VclStylesinno.dll",#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4348
-