Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 06:39
Behavioral task
behavioral1
Sample
Steam Hack v16.2/Steam Hack v16.2.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Steam Hack v16.2/Steam Hack v16.2.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Steam Hack v16.2/Steam Hack v16.2.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Steam Hack v16.2/Steam Hack v16.2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Steam Hack v16.2/msvcr71.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Steam Hack v16.2/msvcr71.dll
Resource
win10v2004-20240611-en
General
-
Target
Steam Hack v16.2/Steam Hack v16.2.dll
-
Size
43KB
-
MD5
40d06ee9166f2e3a6101b0de7a3adf01
-
SHA1
f0e622715bcf84731e1607e6a31d2937c9435f2f
-
SHA256
debde7fb966f8ce9e39e4488162839dcadd2d9f9faca774210f2b2aba1708255
-
SHA512
f12dd1511a157db61c10091b1c5327d148c7ad7caff3ac9a05a1520270c9ffcb1735a3eab7cfff9944ebfa59f3570c8d2eb72ddb0eef86e4bad80212ccf9ded1
-
SSDEEP
768:vNbaQdpRg4UHMIOCketatMQ+hDuNdcSf2dbOevyOrDv+KR:vEQdDgpMIj7t3DuPVfS3HT+KR
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4216 4708 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3852 wrote to memory of 4708 3852 rundll32.exe 83 PID 3852 wrote to memory of 4708 3852 rundll32.exe 83 PID 3852 wrote to memory of 4708 3852 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Steam Hack v16.2\Steam Hack v16.2.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Steam Hack v16.2\Steam Hack v16.2.dll",#12⤵PID:4708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 5523⤵
- Program crash
PID:4216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4708 -ip 47081⤵PID:1848