ff4bacc28cf6eb2e123bb9ef5fc818ace9f83c3c398d2d9ab78b80c224cdb7ba | Triage

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 23:47

Sharing

Report Analysis Logs

General

Target

gamepad_force_focus.dll
Size

75KB
MD5

a9bf753564e1eb9e51c3b0c7209bfd37
SHA1

8eeb41ec22e125b5a36f6e84acb91d7fc27dd6ce
SHA256

1ac8f9f484ba452d3cca023927f5cca5e00150ce859ccef30aa015cddd0f3706
SHA512

5c885a549e89d1dd398ad54dd0d0a9e62aa74f663916a58a7713dd5db4291f978c014e7930316fee9a6c0128fa3841abf85033e0ed21689fa72cc0bdb29ba932
SSDEEP

1536:sLTsIQPOxdKBpzKLkkcgu6YGZ4FbsW1HcdFOs3c34:q0POxdwzKLbu6YGSF2FOss34

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gamepad_force_focus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gamepad_force_focus.dll,#1
  2⤵
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads