8e69a5ef3d94f6836b92915fec004e0320e0fde9fc863f9cdb475d04e52a5cce | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 18:45

Sharing

Report Analysis Logs

General

Target

gameoverlayrenderer.dll
Size

80KB
MD5

36ce8c33db0699b36e13158fd3689c8d
SHA1

e891c3fba09e7acef882e96a3ff68bd5aada6b76
SHA256

607153f0600db89e57e78965f25f914efbe073d678c63b6c146193b7093d1a60
SHA512

80fa7b10b2efeb5c3abac4db1ea89d0d370929257bbc97c6600dc886601eecf32529ddcece96275838477b158a320ad6e2f47da472e466929db79e9c8c7e2482
SSDEEP

1536:oeY/UGk6ahyuDmtGAW0nHO7+g1Qo84csW+/cdgqCtv7YklV:/YUxDmENGHOHF8PgqCtv7YIV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2180	2040	rundll32.exe	28
PID 2040 wrote to memory of 2180	2040	rundll32.exe	28
PID 2040 wrote to memory of 2180	2040	rundll32.exe	28
PID 2040 wrote to memory of 2180	2040	rundll32.exe	28
PID 2040 wrote to memory of 2180	2040	rundll32.exe	28
PID 2040 wrote to memory of 2180	2040	rundll32.exe	28
PID 2040 wrote to memory of 2180	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gameoverlayrenderer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gameoverlayrenderer.dll,#1
  2⤵
  PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads