Overview
overview
10Static
static
3InstaIler.exe
windows10-1703-x64
10amsvcp120.dll
windows10-1703-x64
3dll/libEGL.dll
windows10-1703-x64
1dll/ssleay32.dll
windows10-1703-x64
1files/libs...re.dll
windows10-1703-x64
3files/libs/libEGL.dll
windows10-1703-x64
1files/libs...32.dll
windows10-1703-x64
1files/libs...20.dll
windows10-1703-x64
3files/libs...20.dll
windows10-1703-x64
3files/libs...sw.dll
windows10-1703-x64
1files/libs...32.dll
windows10-1703-x64
1files/libs...it.dll
windows10-1703-x64
1files/libs/wsepno.dll
windows10-1703-x64
1files/libs/wshbth.dll
windows10-1703-x64
1files/libs/wshcon.dll
windows10-1703-x64
7Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25/04/2024, 16:27
Static task
static1
Behavioral task
behavioral1
Sample
InstaIler.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
amsvcp120.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
dll/libEGL.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
dll/ssleay32.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
files/libs/Qt5Core.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
files/libs/libEGL.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
files/libs/libeay32.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
files/libs/msvcp120.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
files/libs/msvcr120.dll
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
files/libs/opengl32sw.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
files/libs/ssleay32.dll
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
files/libs/wsecedit.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
files/libs/wsepno.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
files/libs/wshbth.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
files/libs/wshcon.dll
Resource
win10-20240404-en
General
-
Target
files/libs/msvcp120.dll
-
Size
444KB
-
MD5
fd5cabbe52272bd76007b68186ebaf00
-
SHA1
efd1e306c1092c17f6944cc6bf9a1bfad4d14613
-
SHA256
87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
-
SHA512
1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
-
SSDEEP
12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2576 3264 WerFault.exe 75 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 196 wrote to memory of 3264 196 rundll32.exe 75 PID 196 wrote to memory of 3264 196 rundll32.exe 75 PID 196 wrote to memory of 3264 196 rundll32.exe 75
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\files\libs\msvcp120.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\files\libs\msvcp120.dll,#12⤵PID:3264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 6123⤵
- Program crash
PID:2576
-
-