9c9a5b48379bc3746557057de57fda7a63961cce82d72ec8ff88c6ce2ca2c172 | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 18:52

Sharing

Report Analysis Logs

General

Target

TerrariaFIX.V2/steam_api.dll
Size

254KB
MD5

cc62f2ebf08cf5814e9c78d3804fa98f
SHA1

b2f8a07b657f1de841a1d0be54c9c0303763ec13
SHA256

19ad8f436cc80081f77272974b0b4de361f6c8ef46f09a9263fd764145dc9dfc
SHA512

8f6f98f3e35e34f31e795b3981d52b773ebb98b5949e54814510db5a62ad564434724cb65d59528749aab1765fc0ec9cb67fa54597157ef0fa48ec81a83032e3
SSDEEP

6144:MovOILy800bfy6vgrZciveMdwym52CPFZTn:MovOILy80h6vIqyk2Cvn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1252	1700	rundll32.exe	28
PID 1700 wrote to memory of 1252	1700	rundll32.exe	28
PID 1700 wrote to memory of 1252	1700	rundll32.exe	28
PID 1700 wrote to memory of 1252	1700	rundll32.exe	28
PID 1700 wrote to memory of 1252	1700	rundll32.exe	28
PID 1700 wrote to memory of 1252	1700	rundll32.exe	28
PID 1700 wrote to memory of 1252	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TerrariaFIX.V2\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TerrariaFIX.V2\steam_api.dll,#1
  2⤵
  PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads