6c6aa5f7e4eaf7f1005dc85a24b23a1f6f90731f5292d185f0909092d858c5ae | Triage

Analysis

max time kernel
142s
max time network
138s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 03:14

Sharing

Report Analysis Logs

General

Target

Stardew Valley/FAudio.dll
Size

304KB
MD5

3eb63fe969b86d15d1fa1b46dc3b5ba4
SHA1

85811bd4c66c41b76cbbd96aa644994ace0488b5
SHA256

4f2365ff8e0733b5282f9ccb8c86fc656943150cd28e5c858082df96a07a2d67
SHA512

d1491896b89c8ad911dd1c8f8985d01e3c0ebd9a776081b638f586d44e34efa160a60b3cd3ad12b123fc278ad6924ef646ded1af95515e62a476a5bb07e90d9a
SSDEEP

6144:VFB1uEPlM8JREQmbBcU93764+uNzokW+9++vBVb1tz:FS8JzmbFV7Iu1Ttz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 844 wrote to memory of 1660	844	rundll32.exe	WerFault.exe
PID 844 wrote to memory of 1660	844	rundll32.exe	WerFault.exe
PID 844 wrote to memory of 1660	844	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Stardew Valley\FAudio.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 844 -s 180
  2⤵
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-0-0x000000006D840000-0x000000006D886000-memory.dmp

Filesize
280KB

Download