72b5e76a8256cf479be8ab736165302405cc399be066f8b9d7eb1ba52520e3c1 | Triage

Resubmissions

03/02/2024, 06:55

240203-hp5czabeg7 7

03/02/2024, 06:52

240203-hnee6adhdp 7

03/02/2024, 06:46

240203-hjl97sbdh3 7

03/02/2024, 06:41

240203-hfs9cadfhl 3

03/02/2024, 06:38

240203-hebb5sdffl 3

03/02/2024, 05:47

240203-gg3nqsaee9 8

03/02/2024, 05:22

240203-f2tqwscdcm 7

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 06:46

Sharing

Report Analysis Logs

General

Target

GameAssembly.dll
Size

23.0MB
MD5

69ce2705f5d51da9c2c0f4479b67075c
SHA1

00efffda43830219d4324d7516072dc8320993bc
SHA256

c42c9115e10d6eaa8101015d200bea986d61c240a088705e6afbe0255b1e811b
SHA512

03a2919e9b97fe544dbef8d18f78a7a0df9beebb1d9c8d46a51f1c96a4e3c87b48d99691f1220d72188af3f02d06a542811f27833bcb60c0a4a1feddd1e97f68
SSDEEP

393216:/jB8Z4r6zOU6mxvzfcfivc+nyz2Phd2ICkrJ9KzAKHGLuaonoDqlZAngyAY:/Rz2ziE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1748	2632	rundll32.exe	28
PID 2632 wrote to memory of 1748	2632	rundll32.exe	28
PID 2632 wrote to memory of 1748	2632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GameAssembly.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2632 -s 232
  2⤵
  PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads