8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98 | Triage

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 16:42

Sharing

Report Analysis Logs

General

Target

scripts/wGameScript.dll
Size

21KB
MD5

06b810aceb363540ce50812c438d4c5c
SHA1

23239f04ec2d031215e786728cc9fe7adfb685d1
SHA256

be1d8b6d4b0b626e65248473f9ebcc14dea86a9c769312d241e5342a9cdcdf18
SHA512

9ff86bb70554579c6a6876281bec178af9dade3d483e48f736c520aee08bf4458da5dd384e79a1a7a5877127e615146a30e1d2a405345040fa17fde1547b1ea0
SSDEEP

384:+8yv++D5Y/V57T3rFFnWYH7yTsFAxCM1Iu68FKlRWN/h:+8y9DUnWYzAxJ1IMFgRWn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 4856	1380	rundll32.exe	86
PID 1380 wrote to memory of 4856	1380	rundll32.exe	86
PID 1380 wrote to memory of 4856	1380	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wGameScript.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wGameScript.dll,#1
  2⤵
  PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads