Overview
overview
5Static
static
3PC_PVZ-Fus....1.zip
windows10-2004-x64
1PC_PVZ-Fus....1.zip
windows11-21h2-x64
1GameAssembly.dll
windows10-2004-x64
1GameAssembly.dll
windows11-21h2-x64
1PlantsVsZombiesRH.exe
windows10-2004-x64
5PlantsVsZombiesRH.exe
windows11-21h2-x64
1PlantsVsZo...ed.dll
windows10-2004-x64
1PlantsVsZo...ed.dll
windows11-21h2-x64
1UnityCrash...64.exe
windows10-2004-x64
1UnityCrash...64.exe
windows11-21h2-x64
1UnityPlayer.dll
windows10-2004-x64
1UnityPlayer.dll
windows11-21h2-x64
1baselib.dll
windows10-2004-x64
1baselib.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/05/2026, 22:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PC_PVZ-Fusion-3.6.1.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
PC_PVZ-Fusion-3.6.1.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
GameAssembly.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
GameAssembly.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
PlantsVsZombiesRH.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
PlantsVsZombiesRH.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
PlantsVsZombiesRH_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
PlantsVsZombiesRH_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
UnityCrashHandler64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
UnityCrashHandler64.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
UnityPlayer.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
UnityPlayer.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
baselib.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
baselib.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target PlantsVsZombiesRH.exe
- Size 651KB
- Sample260529-2fnteadt4n
- SHA256 268e4133229d3071e4b55c701c5ab3bea4ebf240c8827fdc790edb6b1b2a268c
- MD5 a2bd3834c56d929704252d458eceb48d
- SHA1 cf1842d3a1f51e79814061aec9d46528ce01f835
- SHA512 50a98dbdfc1c9da9005bf556c03dced2ff332a9150c62bb6cc13a9092fc4bf1f3a02f4abe77a84578801598d1e44cdf76f3b9f640580eba492903753617a402d
- SSDEEP 12288:ZH744aOD8nsmV2eCczU3CAX+dwk7xkKwsBrO:59aOQFwf
- TLSH T17FE495C7B1F1D8C5DE11B938C4E4ADAD8725DEAB9E0F241E08217D9534E913C4AADC3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\UnityPlayer_Win64_player_il2cpp_x64.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\DLL\iphlpapi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\dxgi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\MMDevAPI.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\win32u.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\d3d10warp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\XInput9_1_0.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\UxTheme.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\ntdll.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\gdi32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\oleaut32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dxgi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\devobj.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\cfgmgr32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\cfgmgr32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\advapi32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\version.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\powrprof.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\gdi32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\msvcrt.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\Windows.Storage.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\ntmarta.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\ucrtbase.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\ucrtbase.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\rpcrt4.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\advapi32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\shcore.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\lib_burst_generated.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\dcomp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\TextInputFramework.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\DLL\kernel32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\win32u.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\shlwapi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\ws2_32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\glu32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\WLDP.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\DLL\iphlpapi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\DXCore.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\combase.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dwmapi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\opengl32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\WLDP.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\DXCore.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\powrprof.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\XInput9_1_0.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\CoreUIComponents.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\kernelbase.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\rpcrt4.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\cfgmgr32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\glu32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\Kernel.Appcore.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\MMDevAPI.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\devobj.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\ResourcePolicyClient.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\msvcp_win.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\WindowsPlayer_player_Master_il2cpp_x64.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\exe\WindowsPlayer_player_Master_il2cpp_x64.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\shell32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\shell32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\GameAssembly.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\ResourcePolicyClient.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\dll\WinTypes.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\DLL\hid.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\system32\symbols\dll\profapi.pdb PlantsVsZombiesRH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WindowsPlayer_player_Master_il2cpp_x64.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\rpcrt4.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\shell32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\profapi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\ResourcePolicyClient.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\XInput9_1_0.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\win32u.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\msvcrt.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\winhttp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\glu32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\powrprof.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dcomp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\exe\WindowsPlayer_player_Master_il2cpp_x64.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\kernel32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\gdi32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\bcrypt.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\apphelp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\bcryptprimitives.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\lib_burst_generated.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\XInput9_1_0.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\ucrtbase.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\rpcrt4.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\version.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\apphelp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\GameAssembly.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\audioses.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\sspicli.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\oleaut32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\winhttp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\ntmarta.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\msvcp_win.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\ole32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\bcrypt.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\shell32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\imm32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\winmm.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\combase.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\cfgmgr32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\crypt32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\lib_burst_generated.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\ntmarta.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\UnityPlayer_Win64_player_il2cpp_x64.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\gdi32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\gdi32full.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\dwmapi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\Kernel.Appcore.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\profapi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\iphlpapi.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\d3d10warp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\DLL\kernel32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\ws2_32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\opengl32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\d3d11.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\powrprof.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\ntdll.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\version.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\winhttp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\d3d10warp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\DXCore.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\devobj.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\dcomp.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\DLL\kernel32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\dll\user32.pdb PlantsVsZombiesRH.exe File opened for modification C:\Windows\symbols\dll\combase.pdb PlantsVsZombiesRH.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dwm.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe - Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 452 PlantsVsZombiesRH.exe 452 PlantsVsZombiesRH.exe 1484 UnityCrashHandler64.exe 1484 UnityCrashHandler64.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeCreateGlobalPrivilege 4476 dwm.exe Token: SeChangeNotifyPrivilege 4476 dwm.exe Token: 33 4476 dwm.exe Token: SeIncBasePriorityPrivilege 4476 dwm.exe Token: SeShutdownPrivilege 4476 dwm.exe Token: SeCreatePagefilePrivilege 4476 dwm.exe Token: SeShutdownPrivilege 4476 dwm.exe Token: SeCreatePagefilePrivilege 4476 dwm.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 452 PlantsVsZombiesRH.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 452 wrote to memory of 1484 452 PlantsVsZombiesRH.exe 87 PID 452 wrote to memory of 2192 452 PlantsVsZombiesRH.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesRH.exe"C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesRH.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 452 32716155166722⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 452 -s 41842⤵PID:2192
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a8 0x3381⤵PID:3416
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4476