Analysis

  • max time kernel
    51s
  • max time network
    74s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/02/2023, 16:59

General

  • Target

    MultiMC/imageformats/qico.dll

  • Size

    34KB

  • MD5

    6c3e20e5aea84bb3ea7dfed04d47e359

  • SHA1

    40d1d2ff70a2cb86b59f9226025575b00adab004

  • SHA256

    300cc9b62dbd6fd174e548f68fb06d5195de85d9084887856ce70c30421d05ea

  • SHA512

    a4a201d6008f3f47ab650dd0e6266a95895e31259ba52ddfcbe07aec632e39ce0912ebf30e7b62a9c0155b3d13f898797923e560f90fe78ac79c67f2071e7233

  • SSDEEP

    384:48oL/r5InNQEVQAfZ9EJ0chhCxI8RqnrC+VnhkjqIQ5Cxjl95hj1V2u:01EAqcuxIILCkpOeltb2u

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qico.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qico.dll,#1
      2⤵
        PID:2908

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2908-116-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-117-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-118-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-119-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-120-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-121-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-122-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-123-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-124-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-125-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-127-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-126-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-128-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-129-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-130-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-131-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-132-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-133-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-134-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-135-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-136-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-137-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-139-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-138-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-141-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-140-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-142-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-143-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-144-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-145-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-146-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-147-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-148-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-149-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-150-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-152-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-153-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-151-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-156-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-155-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-154-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-158-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-159-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-157-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-160-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-161-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-163-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-165-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-164-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-162-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB

    • memory/2908-166-0x00000000775B0000-0x000000007773E000-memory.dmp

      Filesize

      1.6MB