a6fbd3cbf15de8a9cecbdddf26c0e1ab5b00f2dc116a9e67f791befc7da2d60c | Triage

Analysis

max time kernel
32s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 13:53

Sharing

Report Analysis Logs

General

Target

CRACK/no mega hack/GDDLLLoader.dll
Size

105KB
MD5

0b4e638e989d0229f2b352f78518b27d
SHA1

32c3470d00690aa15cd886a01a36301585ed1f99
SHA256

fd9bb4d2fd954badf73644001797408fe635a9b0e7b4fcbb7fbb3a287722ef03
SHA512

b77692a339f6aab091c745b74cd162ca7a2a77d04aeaab11ba20d706a122ba3450181d20e6542315110823d23247e8d2f1641064ed6fa9961aed77e5d826a9ad
SSDEEP

3072:ulrTN3gdDnXN0KtTup1zlGs1m8FcfKh6:+rx3sDmKBup1zf8eh6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3520	3384	rundll32.exe	85
PID 3384 wrote to memory of 3520	3384	rundll32.exe	85
PID 3384 wrote to memory of 3520	3384	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CRACK\no mega hack\GDDLLLoader.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CRACK\no mega hack\GDDLLLoader.dll",#1
  2⤵
  PID:3520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads