068e727f7a752a65815025756376baa1ae5622a6518cf8056764cfffa7d0b815 | Triage

Resubmissions

01/10/2024, 19:40

241001-ydxrra1bke 10

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 19:40

Sharing

Report Analysis Logs

General

Target

cheat-Client-18.4/avformat-61.dll
Size

502KB
MD5

179f9ae9eb9e05411966a0d943e75360
SHA1

a543163fbea7ba8061da700133cc97e9ebcda589
SHA256

b72292ed8140957752e45880b597b6e1a673fb66e740379d29614dee1454d3a2
SHA512

ca77ce3fb5e345ea6304c9d405de577b164224df01ca25ce1ae560ab82463dfa6b0dacd6880d8d8821b15d3892f8d12bbee76832dee1cfef083b74f127949fc0
SSDEEP

12288:vHoTMfa6+pLH1SicSrISTE6bj3tZEdEyd:vHp0HnHASfyd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2340	2384	rundll32.exe	31
PID 2384 wrote to memory of 2340	2384	rundll32.exe	31
PID 2384 wrote to memory of 2340	2384	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cheat-Client-18.4\avformat-61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2384 -s 128
  2⤵
  PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x000007FEF7430000-0x000007FEF74B7000-memory.dmp

Filesize
540KB

Download
memory/2384-1-0x000007FEF6670000-0x000007FEF6A3F000-memory.dmp

Filesize
3.8MB

Download
memory/2384-3-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/2384-2-0x000007FEF5550000-0x000007FEF6664000-memory.dmp

Filesize
17.1MB

Download