Analysis

  • max time kernel
    279s
  • max time network
    323s
  • platform
    windows7_x64
  • resource
    win7-20231020-es
  • resource tags

    arch:x64arch:x86image:win7-20231020-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    22/11/2023, 18:46

General

  • Target

    Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/libfastlz.dll

  • Size

    114KB

  • MD5

    a849513963d1c15f63d806237143a262

  • SHA1

    a8a3e1921503c776a7d205672906b4da0e905bdc

  • SHA256

    313b703daaccb3c9435a81c44db5b5b0c76df323aa1e293cff95e758fa4fb93a

  • SHA512

    27d68f6837e763f7e66c5a7af3e9232d9948663f6c191e3960097ba0bec3a5d7da982a3fbf6388af8d79ff157d7129ac9bdcd926429df66623cfa2587b5570f2

  • SSDEEP

    3072:VCwDhTbW10BoSIkop6ePSJqzhrq1wsvKQvYQM:Vf/WOBoXkWPSqVgEQvzM

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Shadows.of.Doubt.v35.07\Shadows.of.Doubt.v35.07\Shadows of Doubt_Data\Plugins\x86_64\libfastlz.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2652 -s 84
      2⤵
        PID:2916

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads