0058b4f69b0e6b9fc2eaca10a9bfb41e72e6cd72a827f8740fefde876194bade | Triage

Analysis

max time kernel
29s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 02:29

Sharing

Report Analysis Logs

General

Target

PowerISO/App/PowerISO64/libFLAC.dll
Size

236KB
MD5

50d9d7cce1ed3422b9a2d972127ac890
SHA1

226f83bfd0ee358840edcf0402ddbae540bb1652
SHA256

fe71ca9e8ccfb7d63e2741ae090bfd9539830022912d1121b5e83caefc2042d9
SHA512

a8fdb1efba72d16a343299a72ac5764f5240b1753f0480afbc1d1a0b235965c29d99e34ad8c43249a416efa52ce09d8126ef1d21065ee3e30b39feaf914a7b4d
SSDEEP

6144:4SEfFLc0EMt9Rs9zTw3Apib2b+u97iFsOGB2gJXFwy:4SYzM9QArb+u9eta3F

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1540	1720	WerFault.exe	24

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1540	1720	rundll32.exe	27
PID 1720 wrote to memory of 1540	1720	rundll32.exe	27
PID 1720 wrote to memory of 1540	1720	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\libFLAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1720 -s 84
  2⤵
  - Program crash
  PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads