fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b | Triage

Analysis

max time kernel
359s
max time network
366s
platform
windows7_x64
resource
win7-20240220-es
resource tags

arch:x64arch:x86image:win7-20240220-eslocale:es-esos:windows7-x64systemwindows
submitted
22-04-2024 19:58

Sharing

Report Analysis Logs

General

Target

$TEMP/PCSX2 1.6.0/Plugins/Spu2-X.dll
Size

4.6MB
MD5

5202596cde4bfc60c867b48957d401fa
SHA1

7b3da7a7d4ae0903188b46cb9a9605973a960d8b
SHA256

b57287a31f43b130dc463b2e2d80399ec50543fa09f7808001a1523bf1f25349
SHA512

db79c7c46289a788cce6e9deacb150983b42ddfa8bab3377c0c165adcf7c110fbb7c733684895a9284c3f9c3d86e660699f37e0fae3407a177bc6258a1ec7505
SSDEEP

98304:1vDs/zXqRD655/Ds/zXOTCp2HLjXr2DNEp:CvH7GN

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

2936 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2720 wrote to memory of 2936	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2936	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2936	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2936	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2936	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2936	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2936	2720	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Plugins\Spu2-X.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Plugins\Spu2-X.dll",#1
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2936

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...