12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1 | Triage

Analysis

max time kernel
435s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/08/2023, 23:39

Sharing

Report Analysis Logs

General

Target

Common Files/AVPlay.dll
Size

72KB
MD5

4e35592f3544734bfe14989a45c6eda7
SHA1

c8b16170c6baeaea34162b6b49bfdca682ed8f4a
SHA256

44ff56566e390848c41f83e7340777282c6a641aec7934fbc8947e55bab03c20
SHA512

8742199b59cb363f5eeb911be6b4ad091377a27d0f934b274b51351e2b959cd0c4a89c0e109a3be4fdc88a0588fec2192d8b454593233b4bbe8fb2696fafd99e
SSDEEP

768:FzWPIyYs5H3y9ZX+XLuUa1RXerLnOoW1NkDYzqsSmwZduLz:F6xYZ9ZXguUFFW1eYzqsBEduLz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4556	4424	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4424	1988	rundll32.exe	84
PID 1988 wrote to memory of 4424	1988	rundll32.exe	84
PID 1988 wrote to memory of 4424	1988	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\AVPlay.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\AVPlay.dll",#1
  2⤵
  PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 620
    3⤵
    - Program crash
    PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4424 -ip 4424
1⤵
PID:4140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4424-133-0x00000000021B0000-0x00000000021C9000-memory.dmp

Filesize
100KB

Download