809afb2bb8fa462096e9c968a357f5f2c06cda43e235d375d8219fa5c4421ca9 | Triage

Analysis

max time kernel
40s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 10:45

Sharing

Report Analysis Logs

General

Target

extensions/s3eSteamwork.dll
Size

127KB
MD5

c834786459b89b1addb291d6d1ec7a04
SHA1

191404b547c94953bbd8793e3d953b158477945e
SHA256

d61e6cd15037978eb7e17accd02256cf0cef526b107cb0214d40d949f7bc983f
SHA512

6e198a71bac40fab7c176624ed596fd02c6be285ff0560ffa68699d57cdcf1db6bc232df42da074d8d375a9f3a560220ab0f58496f42a90bec31bda1cd640ddf
SSDEEP

3072:uGNCJoV2YOkgWe7J8e/Va36y1IX+rg01vD6o:uGNceU8e/VaiAD6o

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1088	4900	rundll32.exe	80
PID 4900 wrote to memory of 1088	4900	rundll32.exe	80
PID 4900 wrote to memory of 1088	4900	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\extensions\s3eSteamwork.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\extensions\s3eSteamwork.dll,#1
  2⤵
  PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads