0058b4f69b0e6b9fc2eaca10a9bfb41e72e6cd72a827f8740fefde876194bade | Triage

Analysis

max time kernel
5s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 02:29

Sharing

Report Analysis Logs

General

Target

PowerISO/App/PowerISO64/libvorbis.dll
Size

1.7MB
MD5

96a8188be8ea41b623d10fda3e2f2cdb
SHA1

776b5ccf84e323e7f77182b08104780479f42cd4
SHA256

841a000c104c5acbc8c5f10c2a3f72e9f8983b138e46543247d371fc821985f0
SHA512

95fe1c8b8b02bb91410a9d1f9168431e0fce66dee4c3ae65b8df6cdf778db3cb8e3a47762c0f17498d89e6ecff27d876cade9540f025ec352d30a6c2968954b8
SSDEEP

6144:lv0FhLxjyfx+yNFbp4RJdnrzVPdGZR032sQO:lcFhdax+yNFbSJdrRkY9T

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	1752	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1952	1752	rundll32.exe	26
PID 1752 wrote to memory of 1952	1752	rundll32.exe	26
PID 1752 wrote to memory of 1952	1752	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\libvorbis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1752 -s 84
  2⤵
  - Program crash
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads