8086a5c301e4b96fbfcbd728c893ba0ca0d038c1815e4ab48bbf3601a78a6e22 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 22:05

Sharing

Report Analysis Logs

General

Target

ffx_fsr2_api_x64.dll
Size

153KB
MD5

d9f2055c7de8b9d25dafaaa2cf17b07b
SHA1

bfd9e5146249406e8fe93d31a125e4ff2411ab3f
SHA256

9b69f730d76aaf59bde1fc916fdfafe37442529913390d07a22709a2cc5a384b
SHA512

f1d07bef5a839b3d7c36a690688d98a6d562d6cd6e8a6398212cdfeec8ee742d576662f3d248565e922de0df94abe33cd31d47abf8ca1bfea266f577859cb6a6
SSDEEP

3072:+7nhqnJfcyBp3gCLPEKpzySRLPJ+iEU+LEg:+7nhoWWpwNSJRIE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2244	856	rundll32.exe	28
PID 856 wrote to memory of 2244	856	rundll32.exe	28
PID 856 wrote to memory of 2244	856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffx_fsr2_api_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 856 -s 84
  2⤵
  PID:2244

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads