3e4c0d38b5e8673c740917bc444ea154bbcfd99e2c424f3e1a8760a00ddc1589 | Triage

Analysis

max time kernel
126s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 18:56

Sharing

Report Analysis Logs

General

Target

joydll.dll
Size

54KB
MD5

4ff7d5e6232f4fa566d5531983aa11b0
SHA1

70fcf011785d3181488d4815b1154c39c57502b1
SHA256

3afbccfbd9dbf261dbfaad44a9428ca3f882b2e6017b79e41df91981e7fd40d4
SHA512

90c8075723bb3636191896f5efa793cfaebf178556ef8f5b41dc56312b3c596333f04a2a0fec5981df5c043a8454b2fb2dcbe5a4df90012fea5c784386a65310
SSDEEP

1536:UYEt8MQGn+JrUyXGXjcDtrqCTzHO7zwKV9ObkGETxEPNZYh5b:UYEt8MkrUyXGXjcDtrqCTzHO7zrV9ObW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 448	1940	rundll32.exe	90
PID 1940 wrote to memory of 448	1940	rundll32.exe	90
PID 1940 wrote to memory of 448	1940	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\joydll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\joydll.dll,#1
  2⤵
  PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads