Overview
overview
10Static
static
7Alcohol_12...51.exe
windows7-x64
10Alcohol_12...51.exe
windows10-2004-x64
10Alcohol_12...32.dll
windows7-x64
1Alcohol_12...32.dll
windows10-2004-x64
1Alcohol_12...32.dll
windows7-x64
3Alcohol_12...32.dll
windows10-2004-x64
3Alcohol_12...32.dll
windows7-x64
1Alcohol_12...32.dll
windows10-2004-x64
1Alcohol_12...32.dll
windows7-x64
3Alcohol_12...32.dll
windows10-2004-x64
3Alcohol_12...ta.exe
windows7-x64
7Alcohol_12...ta.exe
windows10-2004-x64
7Alcohol_12...a0.exe
windows7-x64
1Alcohol_12...a0.exe
windows10-2004-x64
1Alcohol_12...ov.exe
windows7-x64
7Alcohol_12...ov.exe
windows10-2004-x64
7Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 03:28
Behavioral task
behavioral1
Sample
Alcohol_120_v2.0.3/Alcohol.52.Free.Edition.v2.0.3.6951.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Alcohol_120_v2.0.3/Alcohol.52.Free.Edition.v2.0.3.6951.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Alcohol_120_v2.0.3/CRACK/MSIMG32-10.10.2014/msimg32.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Alcohol_120_v2.0.3/CRACK/MSIMG32-10.10.2014/msimg32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Alcohol_120_v2.0.3/CRACK/MSIMG32-19.11.2013/MSIMG32.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
Alcohol_120_v2.0.3/CRACK/MSIMG32-19.11.2013/MSIMG32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Alcohol_120_v2.0.3/CRACK/MSIMG32-21.04.2015/msimg32.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
Alcohol_120_v2.0.3/CRACK/MSIMG32-21.04.2015/msimg32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Alcohol_120_v2.0.3/CRACK/MSIMG32-25.12.2011/MSIMG32.dll
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
Alcohol_120_v2.0.3/CRACK/MSIMG32-25.12.2011/MSIMG32.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Alcohol_120_v2.0.3/data.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Alcohol_120_v2.0.3/data.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Alcohol_120_v2.0.3/data0.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Alcohol_120_v2.0.3/data0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
Alcohol_120_v2.0.3/tool uninstall Alcohol/sptdremov.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Alcohol_120_v2.0.3/tool uninstall Alcohol/sptdremov.exe
Resource
win10v2004-20240508-en
General
-
Target
Alcohol_120_v2.0.3/CRACK/MSIMG32-25.12.2011/MSIMG32.dll
-
Size
2KB
-
MD5
1ab20886611fd265bc2a0680cffc3bc7
-
SHA1
b5f561df6f1cb43d3b66a86e789cb8b300e6fb38
-
SHA256
ff90a422d7451774f8802da6033acf4120051f896a06bd2dd08df8c0e1676ba8
-
SHA512
f4387a2bd813e14cd43cc556c4f2f1c5e5640d9a6ca526fd0fbe4ec1c81e4075edc784e91d78edd78a959d4bb3c066169124714ee7c3f73db31192b4cb18146c
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2316 1680 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1680 2328 rundll32.exe 28 PID 2328 wrote to memory of 1680 2328 rundll32.exe 28 PID 2328 wrote to memory of 1680 2328 rundll32.exe 28 PID 2328 wrote to memory of 1680 2328 rundll32.exe 28 PID 2328 wrote to memory of 1680 2328 rundll32.exe 28 PID 2328 wrote to memory of 1680 2328 rundll32.exe 28 PID 2328 wrote to memory of 1680 2328 rundll32.exe 28 PID 1680 wrote to memory of 2316 1680 rundll32.exe 29 PID 1680 wrote to memory of 2316 1680 rundll32.exe 29 PID 1680 wrote to memory of 2316 1680 rundll32.exe 29 PID 1680 wrote to memory of 2316 1680 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Alcohol_120_v2.0.3\CRACK\MSIMG32-25.12.2011\MSIMG32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Alcohol_120_v2.0.3\CRACK\MSIMG32-25.12.2011\MSIMG32.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 2643⤵
- Program crash
PID:2316
-
-