e5fb3ac8fb37b4bd895e282b5674725c9e0f2010b971899c61fd237b338c2707 | Triage

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 19:17

Sharing

Report Analysis Logs

General

Target

pcsx2-v1.5.0-dev-3390-g2c4af87e1-windows-x86/run_spu2_replay.cmd
Size

86B
MD5

847da08e33e95dfb162e4ac125fc467f
SHA1

82e2077c1fd305dbb4388451f2872b55f9ed1d5f
SHA256

89f92fa07844a36d1c1def36e6850b4b7b33a3798e0a7bc18a2d682bc01a56a5
SHA512

589ab52360b6fb955f1ae653554f0a0a88a02708a5225fd30fe045f49684a52920040f3d3ea7cfc45ddee46aeb494157ffcacc4bba87fda5865f5e3f343298f6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2512	3908	cmd.exe	93
PID 3908 wrote to memory of 2512	3908	cmd.exe	93
PID 3908 wrote to memory of 2512	3908	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pcsx2-v1.5.0-dev-3390-g2c4af87e1-windows-x86\run_spu2_replay.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\syswow64\rundll32.exe
  C:\Windows\syswow64\rundll32 plugins\SPU2-X-dev.dll,_s2r_replay@16 replay_dump.s2r
  2⤵
  PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1032,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
1⤵
PID:372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads