21da587a1d2dcba6833bea0814b0b3fe07cf9f3ae1ffd1772229f6f0ef04cc6a | Triage

Analysis

max time kernel
140s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:20

Sharing

Report Analysis Logs

General

Target

gamingtcui.dll
Size

121KB
MD5

32d0602af57c3d8ed63692f9a2f60bf9
SHA1

8ba252946c156ea85879381009c447a3bc75595c
SHA256

21da587a1d2dcba6833bea0814b0b3fe07cf9f3ae1ffd1772229f6f0ef04cc6a
SHA512

51939a0cee153f09300cbfee2ae83f8662b9b93136e277278f193e38f45e63a918b837d1c1887829a10c5768a851af3029b80bcd72ec6eee43dc60b993087cf3
SSDEEP

3072:QGMy+yjf63a9o1/6TxGbqFrMcfTk4Fe5uCcYadN+v60rDRavI0SCeA:QGMy2bqFrMcfTk4k5oYaraHvRag0/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1788	1396	rundll32.exe	83
PID 1396 wrote to memory of 1788	1396	rundll32.exe	83
PID 1396 wrote to memory of 1788	1396	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gamingtcui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gamingtcui.dll,#1
  2⤵
  PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads