177eb704df67eb4982a6f125fb2b57342e80db27f9bfeea8ff76d8e8ef318801 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 01:05

Sharing

Report Analysis Logs

General

Target

resources/binaries/blitz_palworld.dll
Size

8.3MB
MD5

05d71b0c4e46f640c49a0f88da7dd760
SHA1

b8b8ae8f939138ae33ed5083df42effda87a4f85
SHA256

9c3a7269cc1ac926c50e6923d5c7568a8258efdb4b680afc13191fd0d634ec19
SHA512

40a8efcd5866d332dd5f3788021c7b2940296a46e73a37a22d166faefdc4869fb523feebf048c73b0e3b29d770ea582b9cd661b1f3af81e547275db40f79335b
SSDEEP

196608:l3YwQG/U47chg7xgexpmSm413sBm93/c2xGn:lKG/U4v6Sm413s493/hGn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2632	1836	rundll32.exe	28
PID 1836 wrote to memory of 2632	1836	rundll32.exe	28
PID 1836 wrote to memory of 2632	1836	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz_palworld.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1836 -s 148
  2⤵
  PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads