46844cde9676b0289d253d2c109911d4c7fc0f1e7878fae935129dd848ee0f11 | Triage

Analysis

max time kernel
27s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-04-2023 13:40

Sharing

Report Analysis Logs

General

Target

GameAssembly.dll
Size

87.7MB
MD5

772ce493d9a2bad9f4fc12362516ccf0
SHA1

da9ce281891da92534a7a15d23648bfcfd629322
SHA256

d5f425127fd646ca056eebe4a8a48e0971e8b7ee7682a41eb94daf90d8157b43
SHA512

18db5708c416892d92c6d3be43b075c7697a451f25d4e52be6a8d0f59de0c0fd34961dbbc5e3a7065c680b68a5b1a9a2025b464189fe2408c568b385ea8cd962
SSDEEP

1572864:iRd5gqBc0M6OuPqPZEF98RrrmM9JaWmjxSR5yDnWaETl:+jBx+EET

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1732	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1312	1732	rundll32.exe	28
PID 1732 wrote to memory of 1312	1732	rundll32.exe	28
PID 1732 wrote to memory of 1312	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GameAssembly.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 260
  2⤵
  - Program crash
  PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads