21d01722dffd6a6052e92e89ea2f78a815e9f38d36126e18afca71457f65bd4f | Triage

Analysis

max time kernel
237s
max time network
337s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/03/2023, 15:05

Sharing

Report Analysis Logs

General

Target

Fraps/data/Lib/Lib2.dll
Size

123KB
MD5

b66e8ef9760059c214c231ada9e2eca3
SHA1

bcb851ffc8620eb78cec32b34cca6e204b76690b
SHA256

8e004b21397da84103f8e0d0eef82f561115f51c8b13c6987e103bbfc23d3246
SHA512

e42a4b48a385833fa4c4e81c452f116616df4981c92da6571a690716ce71335578e1bd9bbccca1669cbd2a61d5207336aca4f7c58122795bcc1420bb5f808a35
SSDEEP

3072:eIoBlNE71LDuw644Cc9VJjkIG7SkOxZVYDht:ijNiHuw6F3aDX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 636	1312	rundll32.exe	27
PID 1312 wrote to memory of 636	1312	rundll32.exe	27
PID 1312 wrote to memory of 636	1312	rundll32.exe	27
PID 1312 wrote to memory of 636	1312	rundll32.exe	27
PID 1312 wrote to memory of 636	1312	rundll32.exe	27
PID 1312 wrote to memory of 636	1312	rundll32.exe	27
PID 1312 wrote to memory of 636	1312	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
  2⤵
  PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads