Analysis

  • max time kernel
    49s
  • max time network
    68s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/02/2023, 16:59

General

  • Target

    MultiMC/imageformats/qgif.dll

  • Size

    32KB

  • MD5

    1ef1a6092fe03c6a0177267020296895

  • SHA1

    ece08d540fac0d2fae47842f569b21338288f324

  • SHA256

    b6de91f608820d3c844837dbb7633672d157dbacf3e86dba7c94a4456fa8b43f

  • SHA512

    df146de0aa89e2b8efe3a42e59274d2b5b134875d6fae718a99a558510452e6317db04ed12debd0fc2a866d139eb1c8ed0aa4624b99bd2ab6ed1255f31454223

  • SSDEEP

    384:YcB1cuRZFI0fKt/m89cFGdgLGbtFdbJHakbk5Ko7sqoZpblL5h24:91Ty/pfmyddHakzPlL2

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qgif.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qgif.dll,#1
      2⤵
        PID:2852

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2852-121-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-124-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-123-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-122-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-126-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-125-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-127-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-129-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-131-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-130-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-128-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-132-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-133-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-134-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-135-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-137-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-139-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-141-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-143-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-145-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-146-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-148-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-150-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-151-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-152-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-154-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-155-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-157-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-158-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-156-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-153-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-149-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-147-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-144-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-142-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-140-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-138-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-136-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-159-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-160-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-161-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-162-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-163-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-164-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-166-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-168-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-169-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-167-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-165-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-170-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB

    • memory/2852-171-0x0000000077D90000-0x0000000077F1E000-memory.dmp

      Filesize

      1.6MB