74f311e5b621699555632cd76143b9569a02837d2d8c6a298b7417350ef84346 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 17:30

Sharing

Report Analysis Logs

General

Target

binaries/steam_api64_org_game.dll
Size

281KB
MD5

8fe4f5f3feefc50f25c5a1cd8485ba98
SHA1

c7eeddb97d831cf2d20e8d40d1fcc7d0ecd71a43
SHA256

e61ac9a9ac216d56abc70aaeefedc11708ef45aa1aa48f1dd313adfd9aa99150
SHA512

629cf1b35fcc6d28202647960b260277c90da28b080b8bcdd0426e34c449690a162159e9c7a5ea0c149e8014183748197f2e42da71063dd19759d86d21595cbf
SSDEEP

6144:cuondVdcyyQBzN6aNEAIyZAxioFDycCfbIj:knCIzQaNDx4ycCg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2364	2128	rundll32.exe	16
PID 2128 wrote to memory of 2364	2128	rundll32.exe	16
PID 2128 wrote to memory of 2364	2128	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\binaries\steam_api64_org_game.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2128 -s 116
  2⤵
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads