5d12fb93a3f9c48e0863da39809270af03aac542b74f0145aa3fc4e033b36ddf | Triage

Analysis

max time kernel
131s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:44

Sharing

Report Analysis Logs

General

Target

MultiMC/imageformats/qjpeg.dll
Size

246KB
MD5

c228c1486e203d48d9c7d84d0b631e15
SHA1

1ccdd75d6cd473d00aa17686ec98f509b1e8e360
SHA256

a55cb801a07932d263c980b14abdb464acd8150b9258260efdf535634bfe9811
SHA512

a649078738e69572276a37431c495582f933b04701deded8b5f6dd5b3c6d5b9d338ddb242b71659038d324ca74c2a8f2b229c7beba6f16ddea238f2bcbfae870
SSDEEP

6144:jutAUtpjvlyaX8XZ99bkBRSMArBPkfB917Wu:jutAavlqJMArBPkf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 8 wrote to memory of 3620	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 3620	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 3620	8	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qjpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qjpeg.dll,#1
2⤵
PID:3620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads