204675ed11d30dd3dbc631f798b4364c128eb4e9413f1da195790abf880e8b9a | Triage

Analysis

max time kernel
143s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2022 17:41

Sharing

Report Analysis Logs

General

Target

libass-9.dll
Size

302KB
MD5

d0f7a5ad8ef837fa6b1ec02b1c0ff452
SHA1

c2cd3e369b47ec8a0503ab929ab3247520bf3a15
SHA256

5f673564895592a63b36ed0bca1827a1f14be4f931d57d10565e8ded0d85556b
SHA512

d1adffde8a92660305238d325fc5f4c6103b9da4173466fd656ff246b42035e799593e78684cc2e6de48870ca2c50e513bc89d41453a1e12812b427a76b683ac

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3076 wrote to memory of 3776	3076	rundll32.exe	rundll32.exe
PID 3076 wrote to memory of 3776	3076	rundll32.exe	rundll32.exe
PID 3076 wrote to memory of 3776	3076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libass-9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libass-9.dll,#1
2⤵
PID:3776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3776-132-0x0000000000000000-mapping.dmp

Download