5ad032a28b5d019685fd4bf4032c4d088c3e53f2570738f61aab18cd46f48a31 | Triage

Analysis

max time kernel
58s
max time network
66s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06/09/2024, 21:40

Sharing

Report Analysis Logs

General

Target

discord_game_sdk.dll
Size

3.7MB
MD5

d8cc567718550ae35c1566c3315b90df
SHA1

e5d8120a8a8583fe7e3177ae7d8fe797c002f263
SHA256

527768710ddb0953fce5eb1700c2566b6451135d76f1d0610b63907cd5ba94c5
SHA512

5e1d72bbb466d032596147dd1a90f5ebcaa82d3d56ee7a0b1aa3a37d4bb42e1fcb510b269451a1b9c7f3b8a1c18b1c5f530b200f2fbbe2ec990b4e1c12e6f5e8
SSDEEP

49152:cxytJCv8RbSimYQSaKCZhYtOVt7CPjitem2vUkcWDnVf6OuBimHdXopJErae4/KC:lD400amm+8m4

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4488	OpenWith.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4488	OpenWith.exe
4760	MiniSearchHost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\discord_game_sdk.dll,#1
1⤵
- Modifies registry class
PID:684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:428

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads