a346595fe9232e039e99763b5fab73cb11383d9d8ec5cbafd861e84fb376e30d | Triage

Analysis

max time kernel
177s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 11:37 UTC

Sharing

Report Analysis Logs

General

Target

AMR Player/avutil.dll
Size

19KB
MD5

03dacf694a8cea21279bf786a4f0bfb0
SHA1

f552e0870c1e321ebc111fde8794830e5dd8306c
SHA256

61f218359353971dfe22d751db78364b6e9ef1a6f8ff31333509caaed6b0603e
SHA512

6b6bc4ad0b36dce51cdade5b27ec25b62ee82b1e6f5904ccede99292bcdb3640c12ea497a245fc9f268d487201704ec43662ee78bca0d6ccebe1d707e66f81e2
SSDEEP

384:GAoYF0XGS97LSYy9muvCtfR2TUXx5yQeAabGRGqV7B:NoY+17LSYyIsCNR2wXx5wAabAG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2012	3332	rundll32.exe	79
PID 3332 wrote to memory of 2012	3332	rundll32.exe	79
PID 3332 wrote to memory of 2012	3332	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AMR Player\avutil.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AMR Player\avutil.dll",#1
  2⤵
  PID:2012

Network

DNS

14.110.152.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.110.152.52.in-addr.arpa

IN PTR

Response

209.197.3.8:80

260 B
5
93.184.221.240:80

46 B
40 B
1
1
93.184.221.240:80

322 B
7
20.52.64.200:443

322 B
7
104.80.224.44:443

tls

92 B
111 B
2
2
209.197.3.8:80

260 B
5
209.197.3.8:80

260 B
5

8.8.8.8:53

14.110.152.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

14.110.152.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads