Overview
overview
10Static
static
3Launcher.exe
windows7-x64
10Launcher.exe
windows10-2004-x64
10amdhip64.dll
windows7-x64
1amdhip64.dll
windows10-2004-x64
1concrt140.dll
windows7-x64
1concrt140.dll
windows10-2004-x64
1res_mods/1..._a.pyc
windows7-x64
3res_mods/1..._a.pyc
windows10-2004-x64
3vvmsvcp140.dll
windows7-x64
1vvmsvcp140.dll
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 22:29
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Launcher.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
amdhip64.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
amdhip64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
concrt140.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
concrt140.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
res_mods/1.23.0.0/scripts/client/gui/mods/mod_a.pyc
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
res_mods/1.23.0.0/scripts/client/gui/mods/mod_a.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
vvmsvcp140.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
vvmsvcp140.dll
Resource
win10v2004-20240611-en
General
-
Target
concrt140.dll
-
Size
309KB
-
MD5
31f210ed5c6f2d8faa1d896cda18584b
-
SHA1
5444d919f5014fb6bf58cefc6f01088c32a24a00
-
SHA256
5393f592cded7bd8ae07b2afc3efdcc4a0b05f7e8e74380a267398266fc02d41
-
SHA512
d39aa7acfd982759825b537a9ca5b04e6cdd9c0a28089e0f666ae4b75e84e2e2e58180103da38bea79efe3252cb9f1932efa69b64461cb76173645e8b6ddf3f6
-
SSDEEP
6144:Ylm+bq4hSdOec4xWMXdtvo4KbrniIzb7wQjnWzgCE33g:pmP/eJXzvSCzW3g
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2264 wrote to memory of 1676 2264 rundll32.exe WerFault.exe PID 2264 wrote to memory of 1676 2264 rundll32.exe WerFault.exe PID 2264 wrote to memory of 1676 2264 rundll32.exe WerFault.exe