bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d | Triage

Analysis

max time kernel
258s
max time network
264s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Sharing

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.3/imageformats/qjpeg.dll
Size

331KB
MD5

4c5a4b9ec2f872c38d9c95e5eea56496
SHA1

b5ee9b5f6218553ea3ee568dfb8edf9ff2eba9e8
SHA256

c735982b012a49100b72db7cb2641db5cc5d1e5bb194eddd7841da17860d57d2
SHA512

ccd8da1aab6474426553bb2bd032777fe1089917d28668445cb09f04175a06f99d341f5b44b7460c43334876c905d4619cae3868ef6cd1dd5c5d4d81f2b7e1bd
SSDEEP

6144:qwXMYlKaape/wrjMkPPIQdYeb2eOrsxZYOJ:qQMYkZeK9d/T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3376 wrote to memory of 1520	3376	rundll32.exe	rundll32.exe
PID 3376 wrote to memory of 1520	3376	rundll32.exe	rundll32.exe
PID 3376 wrote to memory of 1520	3376	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\imageformats\qjpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\imageformats\qjpeg.dll,#1
2⤵
PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...