9c9a5b48379bc3746557057de57fda7a63961cce82d72ec8ff88c6ce2ca2c172 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

TerrariaFIX.V2/steam_api.dll
Size

254KB
MD5

cc62f2ebf08cf5814e9c78d3804fa98f
SHA1

b2f8a07b657f1de841a1d0be54c9c0303763ec13
SHA256

19ad8f436cc80081f77272974b0b4de361f6c8ef46f09a9263fd764145dc9dfc
SHA512

8f6f98f3e35e34f31e795b3981d52b773ebb98b5949e54814510db5a62ad564434724cb65d59528749aab1765fc0ec9cb67fa54597157ef0fa48ec81a83032e3
SSDEEP

6144:MovOILy800bfy6vgrZciveMdwym52CPFZTn:MovOILy80h6vIqyk2Cvn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 4600	3748	rundll32.exe	83
PID 3748 wrote to memory of 4600	3748	rundll32.exe	83
PID 3748 wrote to memory of 4600	3748	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TerrariaFIX.V2\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TerrariaFIX.V2\steam_api.dll,#1
  2⤵
  PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads