a8bc86cd95d9cb31d2a958734e7a88af3eb46bab9a91712a21a7bce6afecde1a | Triage

Analysis

max time kernel
138s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
18/02/2024, 08:40

Sharing

Report Analysis Logs

General

Target

MegaMan Unlimited/SDL.dll
Size

355KB
MD5

723f39a2e1084113d429ccbd80b2efbd
SHA1

340de9b3b95420c243aad1ccb1f3e1c39980aa81
SHA256

1259caa8f5b4d052f912b7aa0bd688a15e7ebbd2f2256235a5f766ecbf40dd2a
SHA512

040fe2a22ee8454d42f9f77464d1df5b75934f2e767de95712414d879e1646705ad5e5d95091383322f9a635cfa166174f6babffa2e324dde8b93d0491d996c6
SSDEEP

6144:7fj+QbczfnskkE4H4m/kaoxONp9FA0cvIeGxiwzui:mCczfskkE4H4m8aocN3XV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 1208	4820	rundll32.exe	77
PID 4820 wrote to memory of 1208	4820	rundll32.exe	77
PID 4820 wrote to memory of 1208	4820	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MegaMan Unlimited\SDL.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MegaMan Unlimited\SDL.dll",#1
  2⤵
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads