0c7f13d75cd6aedf9a95973a1e4b4e16f1e497d5032b4355d62c2365f2bd04a6 | Triage

Resubmissions

04/09/2024, 06:11

240904-gxmmfsxbjc 3

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 06:11

Sharing

Report Analysis Logs

General

Target

Balatro.Friends of Jimbo-P2P/mpg123.dll
Size

193KB
MD5

8117d0efb10f06c61320701d6f1ffcc3
SHA1

de424f4f2af03fed2fea306b6d32384fb21eb1ed
SHA256

e13adb64607c3cf29669ef03cbddcc922096874890043047de1d19886babbdfd
SHA512

b8f76ef0693b74a005a6bed4393c2cb4cfd6b8cd5df97428e42cd8a21c33dcd040909223ec7eb444293c94308afecc0005e72573bf605ff0d6df838ed1c41d26
SSDEEP

6144:mZp1yn8vwQDw2MxWsIv2wIu+xxM1BwuHql:oEwJcppyzQR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2896	2748	rundll32.exe	30
PID 2748 wrote to memory of 2896	2748	rundll32.exe	30
PID 2748 wrote to memory of 2896	2748	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Balatro.Friends of Jimbo-P2P\mpg123.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2748 -s 88
  2⤵
  PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads