Analysis

  • max time kernel
    107s
  • max time network
    113s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/02/2023, 16:59

General

  • Target

    MultiMC/imageformats/qsvg.dll

  • Size

    28KB

  • MD5

    37e618aeafae9c8635ba4f8dc99db10a

  • SHA1

    33dc23dd5445e5bd6c508b621786cdd6a11e9dfa

  • SHA256

    46e4a12fab1cf827d7968c3a3d248da59d7ccf6f77c568b37682d0004ae2cd22

  • SHA512

    0a889d3fe2f07b2a86a7563c66ffc120665f6a3f5e9522dee3e267ec9875a3088bd7a1e91788449c0e0a01c0ec1dcf9b8dc4de9aa4bcf08b04aacb7644fbc746

  • SSDEEP

    384:K3C52F7lM1FUmGseLza+ldlxTSgXMw3viAvqmg+h5tdjlx5hiJ:oC5CCUmG9m+ldlIwaAXNflpq

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qsvg.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qsvg.dll,#1
      2⤵
        PID:2588

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2588-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-122-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-126-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-138-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-140-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-142-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-143-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-145-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-148-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-150-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-149-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-152-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-146-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-153-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-155-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-157-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-158-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-160-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-159-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-161-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-163-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-164-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-162-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-166-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-167-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-170-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-169-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB

    • memory/2588-171-0x0000000077A00000-0x0000000077B8E000-memory.dmp

      Filesize

      1.6MB