8662964a0c03e181d3a7cd58824a4367a4e970f333d693a995af83bada214c05 | Triage

Analysis

max time kernel
507s
max time network
512s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2023 20:19

Sharing

Report Analysis Logs

General

Target

MultiMC/imageformats/qsvg.dll
Size

28KB
MD5

7eb5b428de2fd5ce7f361bbf3d6aada4
SHA1

318acc5132492347727bde7ed70516150144b140
SHA256

c818b37d77c84e3a9963a761bae3eefc73cccd3485ee6cb1c085c670041e9c59
SHA512

681fb8a700aee5f44cf1f328c2fea157a98dab12e287f686d408584b5096ac262cb5cd2b2ff1f3c1b6e55d374ade2236118f41ec9c14fbec7014aae0683c1e5d
SSDEEP

384:0F2Z2Eg8ESscKYkiluz0RdysDv2IWsTmqK5J5:SqESTnDRbWH1J

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1224 wrote to memory of 1560	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 1560	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 1560	1224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qsvg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qsvg.dll,#1
2⤵
PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...