5b1cf06320a173cf6871eb843111d7d61a13619f57d32a39a2fd88005f2a5722

Analysis

max time kernel
153s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2023 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.exe
Size

441.9MB
MD5

bed62029f9e5f4cb0f4ba3035ff2a610
SHA1

7e28d733c3f9853f761ceeeb2b51277d0ef33d16
SHA256

5b1cf06320a173cf6871eb843111d7d61a13619f57d32a39a2fd88005f2a5722
SHA512

6d91061777b6a8cd0624c273373cad15c18b74fcf9199fb52313cc1c937e99735ac627c470445d879f50804370a5ed306ac13dbf87cda5414614e94c5bb9db3a
SSDEEP

12582912:O92wH3HdbbpOBfi5711DibP1e+enL4L2ACxDQd:O9243NtOBfo1DibxVaQd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3712	Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.tmp

Loads dropped DLL 1 IoCs

pid	Process
3712	Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 3712	2680	Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.exe	84
PID 2680 wrote to memory of 3712	2680	Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.exe	84
PID 2680 wrote to memory of 3712	2680	Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.exe	84

C:\Users\Admin\AppData\Local\Temp\Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.exe
"C:\Users\Admin\AppData\Local\Temp\Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\is-RDHP0.tmp\Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RDHP0.tmp\Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.tmp" /SL5="$7010A,462809497,350720,C:\Users\Admin\AppData\Local\Temp\Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-RDHP0.tmp\Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.tmp

Filesize
1.3MB

MD5
92f17362d459ab06eb4ac66f30b1377c

SHA1
c1e5bf0cc8a94f4b2f4ca79e8a5a851d83ae082c

SHA256
bf07d84703a12bbaaca22a0ce5e53c1429d60b9ad131687f82f9ca27d54aca31

SHA512
d2c7300a8a61a54de918e0e18f121a796eeabeec0a71f0a73e30dd9085998d7a1f5106f3304607b9e850b9a013a6cefdd14beab22470290e94c9b016571a88a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RDHP0.tmp\Dragon Ball Xenoverse 2 update 1.19.00 - 1.20.00.tmp

Filesize
1.3MB

MD5
92f17362d459ab06eb4ac66f30b1377c

SHA1
c1e5bf0cc8a94f4b2f4ca79e8a5a851d83ae082c

SHA256
bf07d84703a12bbaaca22a0ce5e53c1429d60b9ad131687f82f9ca27d54aca31

SHA512
d2c7300a8a61a54de918e0e18f121a796eeabeec0a71f0a73e30dd9085998d7a1f5106f3304607b9e850b9a013a6cefdd14beab22470290e94c9b016571a88a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RLNLI.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/2680-133-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2680-148-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3712-139-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3712-149-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/3712-150-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads