9c9a5b48379bc3746557057de57fda7a63961cce82d72ec8ff88c6ce2ca2c172 | Triage

Analysis

max time kernel
149s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

TerrariaFIX.V2/steam_api.dll
Size

254KB
MD5

a01d3217bf92f5d523d5957e40b75b31
SHA1

3880a301bc17acca88b95b1118f260b280ca2cce
SHA256

a898f0a733e71d49ca67c4e6d846e65f175fca63fc969f3985a501457b7f867e
SHA512

e5281b94dd40dd71cb818f25ccdc661e4195cb7d42944860c9d4e7586969f74d5c065c382c9d6a66f7c46f38fb59155d28b322cbff74d625bf6289055a1a0d2c
SSDEEP

6144:MovOILy800bfy6vgrZciveMdwym52CPF6Tn:MovOILy80h6vIqyk2Can

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 2576	3748	rundll32.exe	83
PID 3748 wrote to memory of 2576	3748	rundll32.exe	83
PID 3748 wrote to memory of 2576	3748	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TerrariaFIX.V2\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TerrariaFIX.V2\steam_api.dll,#1
  2⤵
  PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-0-0x0000000074180000-0x00000000749DC000-memory.dmp

Filesize
8.4MB

Download