8e86e10a9b3a48604514c4fab81a68afcc48d1cbcf932255afdc8ca85e33c12d | Triage

Analysis

max time kernel
22s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/05/2023, 04:26

Sharing

Report Analysis Logs

General

Target

PvZRT_Data/XBOXGamepad.dll
Size

83KB
MD5

aadd07ff9056c4f925789dccaae69b03
SHA1

c998a63c69f9f211efffdfc9cca65adb73f7af17
SHA256

c5972ea4bfb176e250cbc36d38661e5fd1be47ca235d2032a174097a9b006172
SHA512

f858455c1c0a29d494aff0e2044eafc0a75f677295f2c6a6a13536b459e7bb0cdd20669f94d73ec2c4105f0e10994c8c9219087a08bf373c9a38f8812eded4b5
SSDEEP

1536:q4OVFCrpbqLfqCGnnhi+CYHBWCsWxbScdvVvR7rZ3fLyM:+4lbqTJh+nHBWMPvpRZ3fLyM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1532	1384	rundll32.exe	28
PID 1384 wrote to memory of 1532	1384	rundll32.exe	28
PID 1384 wrote to memory of 1532	1384	rundll32.exe	28
PID 1384 wrote to memory of 1532	1384	rundll32.exe	28
PID 1384 wrote to memory of 1532	1384	rundll32.exe	28
PID 1384 wrote to memory of 1532	1384	rundll32.exe	28
PID 1384 wrote to memory of 1532	1384	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\XBOXGamepad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\XBOXGamepad.dll,#1
  2⤵
  PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads