Analysis

  • max time kernel
    51s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-06-2024 20:26

General

  • Target

    PvZ_Tools_v2.7.5/imageformats/qgif.dll

  • Size

    24KB

  • MD5

    cdf8fbded378deb5cbcac46c1304c803

  • SHA1

    af160aa7b45c62eab1f4c2e0252cbb341e6d6004

  • SHA256

    e7654a0810ea25c90eb74200bd68713dc713022d52e82789fa989000aaec77a8

  • SHA512

    367a5ffa0a3cc7d0f73726750962e956087b1eb7f672db461039f1282dfc352a553526c7299d94dd8b94126a76c5f119de16f35c8ddc0e715a355c7366e917a0

  • SSDEEP

    384:Vfghkmf8Eami5sMY2WKbLEWEwfue8+Y9JW8//90LGg9K83Vwm5qHqs5XL+:6hyudh2XEWNuIkM8//GLGUK2hoHqsFC

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\imageformats\qgif.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\imageformats\qgif.dll,#1
      2⤵
        PID:1392

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    No results found
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      330 B
      5

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      8.8.8.8.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.