1a92dbc49c1256cd2b338e3098fb4028862d74205ecd9903ca016f6b284b86e8 | Triage

Analysis

max time kernel
118s
max time network
143s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 06:33

Sharing

Report Analysis Logs

General

Target

GameAssembly.dll
Size

50.3MB
MD5

70a0b427c7fbadda795a306d4d09ae5b
SHA1

1b6a4619d92fc9ba62655c59762cc1f0dd8147a9
SHA256

ae57a2f13e080c2013f0dea6512396ecc8c01c0edf8d0cce81ef0f72507a8df6
SHA512

c0cc2c6302804f8646d82ce49dbe12ab688992c3165d30b4e1968970003c39a982b735b5a470919dc41a96469a026d0b8c4e97addb3ca064fc66f6a28467cb0b
SSDEEP

393216:Pw1kdM60CTp7dNsfpFyaQdWGW9zCA9wG6Ank2FLFCff3CVaup35OybGoG5oGKAYu:Pp95Z8go1D4Lr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1520	1320	rundll32.exe	30
PID 1320 wrote to memory of 1520	1320	rundll32.exe	30
PID 1320 wrote to memory of 1520	1320	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GameAssembly.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1320 -s 260
  2⤵
  PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads