fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b | Triage

Analysis

max time kernel
446s
max time network
449s
platform
windows10-2004_x64
resource
win10v2004-20240412-es
resource tags

arch:x64arch:x86image:win10v2004-20240412-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
22-04-2024 19:58

Sharing

Report Analysis Logs

General

Target

$TEMP/PCSX2 1.6.0/Plugins/USBnull.dll
Size

19KB
MD5

bf242e823221f1c7b9d570932c84ca24
SHA1

7c46392db41d4a9931f170e9d6f3a9e99b22ad63
SHA256

04efb9c1e4c6ffefad896fcd671c13405bbaa5cefb68d39707fd746bc1bcc804
SHA512

2b1325851f3984d56bb27c6e2c731029b91ce6868b45bf57dbe0c542c51da48029ac8ecb209b2eda82e16b4a7ecd07f804588cdcdcb3865e4340c3b423ff60d3
SSDEEP

384:aZsp/u5t+ZfzOzb/HjSacFJFx64r4HPzNcJau:aZOzZfyn3cNx64r4vzWM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 680 wrote to memory of 1832	680	rundll32.exe	rundll32.exe
PID 680 wrote to memory of 1832	680	rundll32.exe	rundll32.exe
PID 680 wrote to memory of 1832	680	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Plugins\USBnull.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Plugins\USBnull.dll",#1
2⤵
PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...