Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 06:39
Behavioral task
behavioral1
Sample
Steam Hack v16.2/Steam Hack v16.2.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Steam Hack v16.2/Steam Hack v16.2.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Steam Hack v16.2/Steam Hack v16.2.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Steam Hack v16.2/Steam Hack v16.2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Steam Hack v16.2/msvcr71.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Steam Hack v16.2/msvcr71.dll
Resource
win10v2004-20240611-en
General
-
Target
Steam Hack v16.2/msvcr71.dll
-
Size
340KB
-
MD5
86f1895ae8c5e8b17d99ece768a70732
-
SHA1
d5502a1d00787d68f548ddeebbde1eca5e2b38ca
-
SHA256
8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
-
SHA512
3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
-
SSDEEP
6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4680 4660 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4444 wrote to memory of 4660 4444 rundll32.exe 83 PID 4444 wrote to memory of 4660 4444 rundll32.exe 83 PID 4444 wrote to memory of 4660 4444 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Steam Hack v16.2\msvcr71.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Steam Hack v16.2\msvcr71.dll",#12⤵PID:4660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 6003⤵
- Program crash
PID:4680
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4660 -ip 46601⤵PID:1076