ad56deb1677119053a123a8aade4732c9f827017404051d6b23c63af854b99bb | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 13:45

Sharing

Report Analysis Logs

General

Target

csgo_debug.dll
Size

8.0MB
MD5

3bd3b94089640a2e4ff4937155aa1111
SHA1

eea05cf374be7b8f5624d36494aea9ff6c5d9682
SHA256

ad56deb1677119053a123a8aade4732c9f827017404051d6b23c63af854b99bb
SHA512

b357fbe8504ffda03cfcbd538917a2552f407e682ad064fc0ff48cdc8f94d766f67e775586c1944b277e9eabe43445f47b9f67a5b33422179854e8f50548b704
SSDEEP

98304:tDhCIEmPHE4/WxkPeQslMSBqW4GzZ1b6iRENDRXiRuq4:FZHE4WxkPeQ5SBhPzZ1vRE9RSB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\csgo_debug.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\csgo_debug.dll,#1
  2⤵
  PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-0-0x0000000073D60000-0x0000000074CF1000-memory.dmp

Filesize
15.6MB

Download
memory/2508-1-0x0000000073D70000-0x0000000074D01000-memory.dmp

Filesize
15.6MB

Download
memory/2508-2-0x0000000072BC0000-0x0000000073B51000-memory.dmp

Filesize
15.6MB

Download
memory/2508-3-0x0000000073D70000-0x0000000074D01000-memory.dmp

Filesize
15.6MB

Download