4dffdab75bb1ab9040081179720bb087eb75fa4844ac77eee6a3f325a0ad937f | Triage

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 20:16

Sharing

Report Analysis Logs

General

Target

Forza Horizon 2 Inst/Bin/DS8Sound.dll
Size

31KB
MD5

fb7409288d0f668f5491c90a7798b4ef
SHA1

0565feb8617bfd4a645ec17c4a68bd14d579fc67
SHA256

7e651515cbc8201b7724937f2d6c3f565e7d4adae6cb2e92293c597bed75f83d
SHA512

aa92aa57c246d74d7027b25b6dbb2098002f0d8391044461ec623dfa7d8ba9a66491bf6c8fee3362fd5d5c441579a02721afce2ed310c4076a7532377533b62e
SSDEEP

768:foBMGwJIkdPFqSN9ICCokkJNfcAUuVkPx59/U8:foyJzdPFqzCxkklUuVmn9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 724	1308	rundll32.exe	84
PID 1308 wrote to memory of 724	1308	rundll32.exe	84
PID 1308 wrote to memory of 724	1308	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Bin\DS8Sound.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Bin\DS8Sound.dll",#1
  2⤵
  PID:724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads