2ef69f36d3a99e423ae6b8de52168fd26656d0c274845270000b013043daac7e | Triage

Analysis

max time kernel
90s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2022 17:49

Sharing

Report Analysis Logs

General

Target

MultiMC/imageformats/qsvg.dll
Size

28KB
MD5

7eb5b428de2fd5ce7f361bbf3d6aada4
SHA1

318acc5132492347727bde7ed70516150144b140
SHA256

c818b37d77c84e3a9963a761bae3eefc73cccd3485ee6cb1c085c670041e9c59
SHA512

681fb8a700aee5f44cf1f328c2fea157a98dab12e287f686d408584b5096ac262cb5cd2b2ff1f3c1b6e55d374ade2236118f41ec9c14fbec7014aae0683c1e5d
SSDEEP

384:0F2Z2Eg8ESscKYkiluz0RdysDv2IWsTmqK5J5:SqESTnDRbWH1J

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2608	1140	rundll32.exe	80
PID 1140 wrote to memory of 2608	1140	rundll32.exe	80
PID 1140 wrote to memory of 2608	1140	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qsvg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qsvg.dll,#1
  2⤵
  PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-132-0x0000000000000000-mapping.dmp

Download