8e86e10a9b3a48604514c4fab81a68afcc48d1cbcf932255afdc8ca85e33c12d | Triage

Analysis

max time kernel
287s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2023, 04:26

Sharing

Report Analysis Logs

General

Target

PvZRT_Data/XBOXGamepad.dll
Size

83KB
MD5

aadd07ff9056c4f925789dccaae69b03
SHA1

c998a63c69f9f211efffdfc9cca65adb73f7af17
SHA256

c5972ea4bfb176e250cbc36d38661e5fd1be47ca235d2032a174097a9b006172
SHA512

f858455c1c0a29d494aff0e2044eafc0a75f677295f2c6a6a13536b459e7bb0cdd20669f94d73ec2c4105f0e10994c8c9219087a08bf373c9a38f8812eded4b5
SSDEEP

1536:q4OVFCrpbqLfqCGnnhi+CYHBWCsWxbScdvVvR7rZ3fLyM:+4lbqTJh+nHBWMPvpRZ3fLyM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2056	628	rundll32.exe	84
PID 628 wrote to memory of 2056	628	rundll32.exe	84
PID 628 wrote to memory of 2056	628	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\XBOXGamepad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\XBOXGamepad.dll,#1
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads