Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 06:39
Behavioral task
behavioral1
Sample
Steam Hack v16.2/Steam Hack v16.2.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Steam Hack v16.2/Steam Hack v16.2.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Steam Hack v16.2/Steam Hack v16.2.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Steam Hack v16.2/Steam Hack v16.2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Steam Hack v16.2/msvcr71.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Steam Hack v16.2/msvcr71.dll
Resource
win10v2004-20240611-en
General
-
Target
Steam Hack v16.2/msvcr71.dll
-
Size
340KB
-
MD5
86f1895ae8c5e8b17d99ece768a70732
-
SHA1
d5502a1d00787d68f548ddeebbde1eca5e2b38ca
-
SHA256
8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
-
SHA512
3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
-
SSDEEP
6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2016 2860 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2860 1656 rundll32.exe 28 PID 1656 wrote to memory of 2860 1656 rundll32.exe 28 PID 1656 wrote to memory of 2860 1656 rundll32.exe 28 PID 1656 wrote to memory of 2860 1656 rundll32.exe 28 PID 1656 wrote to memory of 2860 1656 rundll32.exe 28 PID 1656 wrote to memory of 2860 1656 rundll32.exe 28 PID 1656 wrote to memory of 2860 1656 rundll32.exe 28 PID 2860 wrote to memory of 2016 2860 rundll32.exe 29 PID 2860 wrote to memory of 2016 2860 rundll32.exe 29 PID 2860 wrote to memory of 2016 2860 rundll32.exe 29 PID 2860 wrote to memory of 2016 2860 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Steam Hack v16.2\msvcr71.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Steam Hack v16.2\msvcr71.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 2243⤵
- Program crash
PID:2016
-
-