0c0b0d512f3e2aad3a85660950acd7071cedf9e2d33601be7c068645dc64b42e | Triage

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

steamclient.dll
Size

752KB
MD5

4de5221403e851ca25cc2404bdf91e49
SHA1

3b4b72419de3baef2c4e416e3a449c10875c6dec
SHA256

6f6669e8a290cbeacfc71957dc9555bdc56136e45c6708eff6bd4566c9f7cc54
SHA512

9774674848f461850a850de4fbcf449c1550800f4bbc2382acad03c2a2dacfb13d14be89d803f18a4b2a30427e345281696687d42a68605148fcf6cd75281230
SSDEEP

12288:C2s04e1ZxCwT7bNgRSYhgBei2l/g/HqtAC67BzqvijD2y/:C2L445gRSYhDi2SCqC67NV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4888	rundll32.exe
4888	rundll32.exe
4888	rundll32.exe
4888	rundll32.exe
4888	rundll32.exe
4888	rundll32.exe
4888	rundll32.exe
4888	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4888	1952	rundll32.exe	14
PID 1952 wrote to memory of 4888	1952	rundll32.exe	14
PID 1952 wrote to memory of 4888	1952	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\steamclient.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\steamclient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads