21d01722dffd6a6052e92e89ea2f78a815e9f38d36126e18afca71457f65bd4f | Triage

Analysis

max time kernel
145s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 15:05

Sharing

Report Analysis Logs

General

Target

Fraps/data/Lib/Lib.dll
Size

136KB
MD5

5575c0b18e0378e31bea3bdd1b7f56d7
SHA1

10b4e68b068273ae6855da71ad4bedff3f6a5c1a
SHA256

9e57a635148fa12e9c7e1817e4032128c76ece5398c570fdbabf5704a3ad859e
SHA512

4b8360e39393bd7f5defff05e2ea84cd7c4aa36bd7073ca601161fba5a49c133f635dce02ae5c68d602576ce5c7a8617eae6bbaaa4f5aa8787619adf7f715dab
SSDEEP

3072:XexnWRRponullA+kb5/5/cPBP2zHTkfDxXVDH:euRpHla+CO2HQHH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1116	4960	rundll32.exe	81
PID 4960 wrote to memory of 1116	4960	rundll32.exe	81
PID 4960 wrote to memory of 1116	4960	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib.dll,#1
  2⤵
  PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1116 -ip 1116
1⤵
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads