72ee12d327cd931dd6c12b6450148f42a1a33ace2d01618e8eb95b55570db300 | Triage

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 00:34

Sharing

Report Analysis Logs

General

Target

xash/valve/cl_dlls/GameUI.dll
Size

823KB
MD5

4c8de6f302d592b6da05b386efe8afac
SHA1

1bf6ab88c0cd99f0d196a39bdd0e0903e3457fb8
SHA256

0c43c0c20f33c5d79fe48e3fa0fefcf37f626ce5a74581a1048171dbf000c10b
SHA512

cca592a78f9188a83c35187220dda69dee813427610af0a802377e3ee1a52eee4341f56ecdd02d748a4eca832f0984801146232df70b869c3b817a1545f8beb8
SSDEEP

24576:Mtbf+OJdHg811+XochIxmj/a+UkhmqRdi+Kre/lo:b1Ljew48o

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2984	2780	rundll32.exe	30
PID 2780 wrote to memory of 2984	2780	rundll32.exe	30
PID 2780 wrote to memory of 2984	2780	rundll32.exe	30
PID 2780 wrote to memory of 2984	2780	rundll32.exe	30
PID 2780 wrote to memory of 2984	2780	rundll32.exe	30
PID 2780 wrote to memory of 2984	2780	rundll32.exe	30
PID 2780 wrote to memory of 2984	2780	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xash\valve\cl_dlls\GameUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xash\valve\cl_dlls\GameUI.dll,#1
  2⤵
  PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads