Overview
overview
10Static
static
7file_x86x6...40.dll
windows7-x64
1file_x86x6...40.dll
windows10-2004-x64
1file_x86x6...le.exe
windows7-x64
10file_x86x6...le.exe
windows10-2004-x64
10file_x86x6...40.dll
windows7-x64
1file_x86x6...40.dll
windows10-2004-x64
1file_x86x6..._a.pyc
windows7-x64
3file_x86x6..._a.pyc
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 20:33
Behavioral task
behavioral1
Sample
file_x86x64_release/concrt140.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
file_x86x64_release/concrt140.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
file_x86x64_release/file.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
file_x86x64_release/file.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
file_x86x64_release/msvcp140.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
file_x86x64_release/msvcp140.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
file_x86x64_release/res_mods/1.23.0.0/scripts/client/gui/mods/mod_a.pyc
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
file_x86x64_release/res_mods/1.23.0.0/scripts/client/gui/mods/mod_a.pyc
Resource
win10v2004-20240426-en
General
-
Target
file_x86x64_release/concrt140.dll
-
Size
309KB
-
MD5
31f210ed5c6f2d8faa1d896cda18584b
-
SHA1
5444d919f5014fb6bf58cefc6f01088c32a24a00
-
SHA256
5393f592cded7bd8ae07b2afc3efdcc4a0b05f7e8e74380a267398266fc02d41
-
SHA512
d39aa7acfd982759825b537a9ca5b04e6cdd9c0a28089e0f666ae4b75e84e2e2e58180103da38bea79efe3252cb9f1932efa69b64461cb76173645e8b6ddf3f6
-
SSDEEP
6144:Ylm+bq4hSdOec4xWMXdtvo4KbrniIzb7wQjnWzgCE33g:pmP/eJXzvSCzW3g
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1704 wrote to memory of 2488 1704 rundll32.exe WerFault.exe PID 1704 wrote to memory of 2488 1704 rundll32.exe WerFault.exe PID 1704 wrote to memory of 2488 1704 rundll32.exe WerFault.exe