Analysis

  • max time kernel
    48s
  • max time network
    68s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14-02-2023 16:59

General

  • Target

    MultiMC/imageformats/qjpeg.dll

  • Size

    241KB

  • MD5

    05493d8b0a115eadf4d6554536fb64f5

  • SHA1

    3c88150fd6fda55d8d04fa069f9b71e25a4190fd

  • SHA256

    70c010129e4168ec8428fdaebba2b1d1bae77223af3beff35dc0936af40d758a

  • SHA512

    0705efc404404822761348e09462ba3b1422bbbc8e876f163fd504de2d9f12f00c112ff84ba23091baffe92935bd4197a7bd923ac380acaa9d70e95ca989e440

  • SSDEEP

    6144:91ebhrhe7tWya28H3m9IsBRSAok6fd+q9tkli:91GhrsWWUAok6f4

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qjpeg.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qjpeg.dll,#1
      2⤵
        PID:3480

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3480-120-0x0000000000000000-mapping.dmp

    • memory/3480-121-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-122-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-123-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-124-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-125-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-126-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-127-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-128-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-129-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-130-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-131-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-132-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-133-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-134-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-135-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-136-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-137-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-138-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-139-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-140-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-141-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-143-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-142-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-144-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-145-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-146-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-147-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-148-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-149-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-150-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-151-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-152-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-154-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-153-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-156-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-155-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-158-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-157-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-159-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-160-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-161-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-162-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-163-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-164-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-166-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-167-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-165-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-169-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-170-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-168-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB

    • memory/3480-171-0x0000000077340000-0x00000000774CE000-memory.dmp

      Filesize

      1.6MB