Analysis

  • max time kernel
    1345s
  • max time network
    1170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/12/2023, 17:45

General

  • Target

    2.1/XINPUT/XboxOneDriver.dll

  • Size

    12KB

  • MD5

    0ce911537be1b9cd74a9112941cafc3a

  • SHA1

    4611938206ef90c8ef77aa8d577cbadb77d5dd62

  • SHA256

    c24a29e711c160ffc35bacd7ba7178f36dfd098236e319478f3887abed299df9

  • SHA512

    65343fad677696284f83319d92832d4f4cff9e206249c5a951c0644522bbd9b799ae3e42e3ac5545b4bd7e271c2dab8d724418d66b13cc8d7fa734f2118852fa

  • SSDEEP

    192:ClpoJWtexWXtL9x7s7fHNGkDdGDbeOosrFXoG2cINpph:ZJWthXItGAOHF/2rN9

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.1\XINPUT\XboxOneDriver.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.1\XINPUT\XboxOneDriver.dll,#1
      2⤵
        PID:2704
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 984
          3⤵
          • Program crash
          PID:1712
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2704 -ip 2704
      1⤵
        PID:3228

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2704-0-0x0000000002F00000-0x0000000002F10000-memory.dmp

        Filesize

        64KB

      • memory/2704-1-0x00000000054F0000-0x00000000054FC000-memory.dmp

        Filesize

        48KB

      • memory/2704-2-0x0000000074C60000-0x0000000074C6C000-memory.dmp

        Filesize

        48KB

      • memory/2704-3-0x0000000074320000-0x0000000074AD0000-memory.dmp

        Filesize

        7.7MB

      • memory/2704-4-0x0000000074320000-0x0000000074AD0000-memory.dmp

        Filesize

        7.7MB