39e1780e7003dfbeb31a0b0c1d1c9c72c7eeaafa30cd1408757b9ceb56916e93 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 15:28

Sharing

Report Analysis Logs

General

Target

TKGameChatCtrl.dll
Size

104KB
MD5

ea18569f0db24a4f2b71acad9eb19c1e
SHA1

56c1e1f2060db30ccf20111ace8b0a8aefb1a256
SHA256

a31f6354efc4e6d96f88f5380c366bf5eb069758d48dda88f389d79d8c0b9c01
SHA512

e74fcb602ee2c1d39e7bfcef2ea7cc81e896b5ef2732d72a3027f40b828e7c7e90a4581cf27a4b5c4bea01b4fc50389578a81babdcac4103ad9880c5da41ef53
SSDEEP

1536:UN5FgfOWojL3YfTpIvBdAjbczSOIutqYMcwAovJmnzhy4:OgUjL0NIv8dOPqYRDkJazhy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	1524	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 1524	4080	rundll32.exe	83
PID 4080 wrote to memory of 1524	4080	rundll32.exe	83
PID 4080 wrote to memory of 1524	4080	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TKGameChatCtrl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TKGameChatCtrl.dll,#1
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 680
    3⤵
    - Program crash
    PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1524 -ip 1524
1⤵
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads