068e727f7a752a65815025756376baa1ae5622a6518cf8056764cfffa7d0b815 | Triage

Resubmissions

01/10/2024, 19:40

241001-ydxrra1bke 10

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 19:40

Sharing

Report Analysis Logs

General

Target

cheat-Client-18.4/avutil-59.dll
Size

1000KB
MD5

9f4e1d61cf779052fed243c2142495b2
SHA1

246b28f23c542ba6f38767ad420fc4b6f716c8af
SHA256

cd256113d455d362d769a859d2214b9f672be8d2692eebd7539675d31620ca6b
SHA512

f3059d52d93731fee5fc03af389ea08f85f449caadc79a0021fe3da2234648ad3bbf012d96eddd2de161bab062bb8be3a9bc98114cb941bb46c1e0117c241593
SSDEEP

12288:4wCIUQiy/TXud3kOo09O11s5mbxZnBR2XoR6nP3J:4uioXud3kOn9x8fqYRoJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3060	2268	rundll32.exe	30
PID 2268 wrote to memory of 3060	2268	rundll32.exe	30
PID 2268 wrote to memory of 3060	2268	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cheat-Client-18.4\avutil-59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 96
  2⤵
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-1-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/2268-0-0x000007FEF3F00000-0x000007FEF5014000-memory.dmp

Filesize
17.1MB

Download