8e86e10a9b3a48604514c4fab81a68afcc48d1cbcf932255afdc8ca85e33c12d | Triage

Analysis

max time kernel
199s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2023, 04:26

Sharing

Report Analysis Logs

General

Target

PvZRT_Data/Box2DBase.dll
Size

287KB
MD5

0572d03da13e13cecdccff2e64f9f4f5
SHA1

a1fcc08ac261edeb3c2b95f007c93fe1398583c7
SHA256

c4507e348be20dacff1caf80047009924a7dafde2f6d4fcd3a119e36c3b0a259
SHA512

68790d0a9b0ccac5389e551408c10bcb2430daa28162bf8de29fe327c78c72bc61181366d6e0f61ba661977daa825aa865255b71ba4cd0ecbc0f403d608d71d0
SSDEEP

6144:n3Hyu+yR3JQ5vqrs5+WK3SjNubJa11F6ZoalgbFOZNu:n3SujQZjEaDF6Rybd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2032	1548	rundll32.exe	82
PID 1548 wrote to memory of 2032	1548	rundll32.exe	82
PID 1548 wrote to memory of 2032	1548	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\Box2DBase.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\Box2DBase.dll,#1
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads