2d3ddaf7da231e79bff773a421526458128ca84cf4aaf5f06bad31e20e06cde5 | Triage

Analysis

max time kernel
102s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20231025-es
resource tags

arch:x64arch:x86image:win10v2004-20231025-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
06/11/2023, 12:36

Sharing

Report Analysis Logs

General

Target

adventure Time/Crack/steam_api.dll
Size

29KB
MD5

26b7184431da94f55083acef69160ea6
SHA1

14058ab7fc67ddc4841bd3149f2c81b54a14363c
SHA256

7ce56431e40f4caf344b42152c2423cf78bc76a82d010fab6fb808f59b08eb2d
SHA512

776c511de90759625e05f8e38b83a1d8d81f7e989e2e239eafaab4c0a4460afb2afd1a5afc35926dcf3d58912d83026dd82f92041675491b56b27da7708a7198
SSDEEP

384:lMnfvsxXjRC4TeAyKI5mO5mUnPQxunq4es5am01iBdVV:lMfvgEeeRP6C6iatuVV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2228	4836	rundll32.exe	40
PID 4836 wrote to memory of 2228	4836	rundll32.exe	40
PID 4836 wrote to memory of 2228	4836	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\adventure Time\Crack\steam_api.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\adventure Time\Crack\steam_api.dll",#1
  2⤵
  PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads