8e69a5ef3d94f6836b92915fec004e0320e0fde9fc863f9cdb475d04e52a5cce | Triage

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 18:45

Sharing

Report Analysis Logs

General

Target

steam_api.dll
Size

102KB
MD5

d50dad71febaa1b8de272ca295a69d1c
SHA1

fa6a4a90c9e60ae7ffa7d11b6daa9082b3b48f25
SHA256

e0e5d7002609ecbf37cc02e49832123e535afd08fb8df6216f0723032975c53b
SHA512

4f35f4a72283a4722e8d9516de45a289aaf4c92584c3829f2438761b6e31349c3f76e92f0e6e48132fdc55956b5dc797fcdbecc80eea89f34057c9571b5911f3
SSDEEP

1536:dPdtkrNFNwJ5gcVJbR3rKiIfvwYUJRqvzK7/pmfaiRuiJD2xzks2QJa8qhT:VHke59JbhKXAYCrAy15vJa8i

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 880	2296	rundll32.exe	96
PID 2296 wrote to memory of 880	2296	rundll32.exe	96
PID 2296 wrote to memory of 880	2296	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\steam_api.dll,#1
  2⤵
  PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads