Overview
overview
7Static
static
7virtualdub...up.exe
windows7-x64
1virtualdub...up.exe
windows10-2004-x64
1virtualdub...er.dll
windows7-x64
7virtualdub...er.dll
windows10-2004-x64
7virtualdub...rt.dll
windows7-x64
3virtualdub...rt.dll
windows10-2004-x64
3virtualdub...er.dll
windows7-x64
1virtualdub...er.dll
windows10-2004-x64
1virtualdub...er.dll
windows7-x64
7virtualdub...er.dll
windows10-2004-x64
7audio-filters.html
windows7-x64
1audio-filters.html
windows10-2004-x64
1capwarn.html
windows7-x64
1capwarn.html
windows10-2004-x64
1crash.html
windows7-x64
1crash.html
windows10-2004-x64
1d-audiocom...n.html
windows7-x64
1d-audiocom...n.html
windows10-2004-x64
1d-audiocon...n.html
windows7-x64
1d-audiocon...n.html
windows10-2004-x64
1d-audiofilters.html
windows7-x64
1d-audiofilters.html
windows10-2004-x64
1d-audioint...g.html
windows7-x64
1d-audioint...g.html
windows10-2004-x64
1d-audiovolume.html
windows7-x64
1d-audiovolume.html
windows10-2004-x64
1d-capturep...s.html
windows7-x64
1d-capturep...s.html
windows10-2004-x64
1d-captures...s.html
windows7-x64
1d-captures...s.html
windows10-2004-x64
1d-capturevumeter.html
windows7-x64
1d-capturevumeter.html
windows10-2004-x64
1Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:05
Behavioral task
behavioral1
Sample
virtualdubmod/AuxSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
virtualdubmod/AuxSetup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
virtualdubmod/AviSynthLexer.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
virtualdubmod/AviSynthLexer.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
virtualdubmod/PlugIns/Smart.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
virtualdubmod/PlugIns/Smart.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
virtualdubmod/PlugIns/Subtitler.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
virtualdubmod/PlugIns/Subtitler.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
virtualdubmod/SciLexer.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
virtualdubmod/SciLexer.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
audio-filters.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
audio-filters.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
capwarn.html
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
capwarn.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
crash.html
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
crash.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
d-audiocompression.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
d-audiocompression.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
d-audioconversion.html
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
d-audioconversion.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
d-audiofilters.html
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
d-audiofilters.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
d-audiointerleaving.html
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
d-audiointerleaving.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
d-audiovolume.html
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
d-audiovolume.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
d-capturepreferences.html
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
d-capturepreferences.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
d-capturesettings.html
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
d-capturesettings.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
d-capturevumeter.html
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
d-capturevumeter.html
Resource
win10v2004-20240426-en
General
-
Target
virtualdubmod/SciLexer.dll
-
Size
143KB
-
MD5
f8253c3a4d60b01a2e312ba0530c5151
-
SHA1
c125455cf3d87557379a7036e4385dd8aa920cde
-
SHA256
67e9dc5e46c44ab5c37d67e83cab2068a3f638fb17ee37e439cd378fc0ac4cad
-
SHA512
532c084ed453bc700a809f2368d5ad05777c820a6a0f82fc56c6ba114a3516787f4de741e9e6fb24e8363bcb7ccf0a7847dd94d75fa5b42e9610c66826342974
-
SSDEEP
3072:nAhC+t5nDcf/uOETgrCZbcH8xMTM9hreQO55WYJ3ZGNgYSV5zYe:AUw1DpsrCxcRTacOgHpR
Malware Config
Signatures
-
resource yara_rule behavioral10/memory/1888-0-0x0000000061080000-0x00000000610EA000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 5096 1888 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2924 wrote to memory of 1888 2924 rundll32.exe 82 PID 2924 wrote to memory of 1888 2924 rundll32.exe 82 PID 2924 wrote to memory of 1888 2924 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualdubmod\SciLexer.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualdubmod\SciLexer.dll,#12⤵PID:1888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 6123⤵
- Program crash
PID:5096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1888 -ip 18881⤵PID:348