8e86e10a9b3a48604514c4fab81a68afcc48d1cbcf932255afdc8ca85e33c12d | Triage

Analysis

max time kernel
25s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/05/2023, 04:26

Sharing

Report Analysis Logs

General

Target

PvZRT_Data/Box2DBase.dll
Size

287KB
MD5

0572d03da13e13cecdccff2e64f9f4f5
SHA1

a1fcc08ac261edeb3c2b95f007c93fe1398583c7
SHA256

c4507e348be20dacff1caf80047009924a7dafde2f6d4fcd3a119e36c3b0a259
SHA512

68790d0a9b0ccac5389e551408c10bcb2430daa28162bf8de29fe327c78c72bc61181366d6e0f61ba661977daa825aa865255b71ba4cd0ecbc0f403d608d71d0
SSDEEP

6144:n3Hyu+yR3JQ5vqrs5+WK3SjNubJa11F6ZoalgbFOZNu:n3SujQZjEaDF6Rybd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\Box2DBase.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\Box2DBase.dll,#1
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads