bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d | Triage

Analysis

max time kernel
294s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Sharing

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.3/Qt5Gui.dll
Size

4.5MB
MD5

744cc7de06ac25c2b7ef4117bd9d99fe
SHA1

8c81cb46987c5b0333557019057429d1e5ba9487
SHA256

1a632df920a31e8334233f67002cd34f31751e0808c11f236c03f2d10f671533
SHA512

743e5027db4154596e4d5f63ebaa6d7469e8116819cdffdd6456c9af4c60c1ff00e389cd1ab94abf407247e9cf985fee8a25a99a1d524a0fb8bd3881c7e74f20
SSDEEP

98304:0X9YxZyh9nPpMSX585WX6rDPoZIiaiE8Tqw:8rXPpMa585WX63PAIT78W

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1224 wrote to memory of 4224	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 4224	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 4224	1224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\Qt5Gui.dll,#1
2⤵
PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...