b95106de4cce90d9ed2ffbd3a10d63219834dd62b2ca84d0af1718961523eaa5 | Triage

Analysis

max time kernel
57s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 12:24

Sharing

Report Analysis Logs

General

Target

Fallout 2/f2_res.dll
Size

284KB
MD5

e1686ce133b25c5d34f307c79c445fd4
SHA1

0a7177ee07b3b258d9929aafb1f68ee7a1a17ddd
SHA256

2d3c52cf624b22958db7fa44e3db71c2d0478503da5ceb40f0636dea1202fb5a
SHA512

4afb4a34c8de700a094270b4db945d6162a5525a77c200a5d72b5fe2e40c365486bbfd112d5dbd82eacd71a8d8a378d6eeb8e1e186f68bf2f7c91e1dcc429bec
SSDEEP

6144:h+LSX7XfbdH1RDVyfC5IwhBiCohEN3a2ja+CEmL:h+eX7XfJb9VhBiCoh2a2bCr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 3492	1764	rundll32.exe	86
PID 1764 wrote to memory of 3492	1764	rundll32.exe	86
PID 1764 wrote to memory of 3492	1764	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Fallout 2\f2_res.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Fallout 2\f2_res.dll",#1
  2⤵
  PID:3492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads