406a23ff989e9ea29398993c0842f5a0202c3cffa54ef2fa21798767624d4719 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 14:15

Sharing

Report Analysis Logs

General

Target

Fraps/data/Lib/Lib.dll
Size

137KB
MD5

8b5a4327dd67b631985471019c6229bc
SHA1

777c00d8a8569738ad6fb8e04eda26305adfe278
SHA256

393f97aae4086bf5f0b0384f21be82f72f402384f3cb2ed27466573e5706e94d
SHA512

01e428961720e6204aa4bb33ea04f153f670a0ec47e8b99cfbc94b2d8d7ba153bb17fdaeb5e4c6b14dd7e4b538ca5c980768e5208efab95bb8d53ecf3e7bd4d4
SSDEEP

3072:kX0BpBQhnSjU3li1eV6cYkAVHBP2zHTszIxXVD1L:RHKhnt341e5ooH0m1L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2216	2084	rundll32.exe	28
PID 2084 wrote to memory of 2216	2084	rundll32.exe	28
PID 2084 wrote to memory of 2216	2084	rundll32.exe	28
PID 2084 wrote to memory of 2216	2084	rundll32.exe	28
PID 2084 wrote to memory of 2216	2084	rundll32.exe	28
PID 2084 wrote to memory of 2216	2084	rundll32.exe	28
PID 2084 wrote to memory of 2216	2084	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib.dll,#1
  2⤵
  PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads