Overview
overview
7Static
static
3CurseOfTwilight.exe
windows10-1703-x64
7$PLUGINSDI...ls.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3CurseOfTwilight.exe
windows10-1703-x64
7LICENSES.c...m.html
windows10-1703-x64
6d3dcompiler_47.dll
windows10-1703-x64
1ffmpeg.dll
windows10-1703-x64
1libEGL.dll
windows10-1703-x64
1libGLESv2.dll
windows10-1703-x64
1locales/de.ps1
windows10-1703-x64
1resources/elevate.exe
windows10-1703-x64
1vk_swiftshader.dll
windows10-1703-x64
1vulkan-1.dll
windows10-1703-x64
1$PLUGINSDI...7z.dll
windows10-1703-x64
3Analysis
-
max time kernel
127s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
02/03/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
CurseOfTwilight.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
CurseOfTwilight.exe
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
LICENSES.chromium.html
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
d3dcompiler_47.dll
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
ffmpeg.dll
Resource
win10-20240221-en
Behavioral task
behavioral8
Sample
libEGL.dll
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
libGLESv2.dll
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
locales/de.ps1
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
vk_swiftshader.dll
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
vulkan-1.dll
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10-20240221-en
General
-
Target
$PLUGINSDIR/nsis7z.dll
-
Size
424KB
-
MD5
80e44ce4895304c6a3a831310fbf8cd0
-
SHA1
36bd49ae21c460be5753a904b4501f1abca53508
-
SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
-
SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
SSDEEP
6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4196 4020 WerFault.exe 73 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1360 wrote to memory of 4020 1360 rundll32.exe 73 PID 1360 wrote to memory of 4020 1360 rundll32.exe 73 PID 1360 wrote to memory of 4020 1360 rundll32.exe 73
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#12⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 6203⤵
- Program crash
PID:4196
-
-