8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 11:05

Sharing

Report Analysis Logs

General

Target

mux/libmux_asf_plugin.dll
Size

60KB
MD5

420100cead6a6ae3d619e2cd4b7448f2
SHA1

b6e1ea9774d1ec269925c6d4fd46eeeff7f931c3
SHA256

5ac3c446bc787bac3c2c62559933970b3dc7fc7ad6ebe441838261b57a17a1b1
SHA512

9e207c57995fec461be8c7f221028a652d9762797d1b98132f70d4de50c1660c8742378457482f820f2282ae52e6270f46a9ed763fbd56ceb538e48d58b73eb1
SSDEEP

768:5uxLpzla9aotNVxA7xDjDNn0aVZI94e5i+XzDGFhcQDGFhmQH:Opl+aottmjhn0YG2Q6Q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2856	2112	rundll32.exe	28
PID 2112 wrote to memory of 2856	2112	rundll32.exe	28
PID 2112 wrote to memory of 2856	2112	rundll32.exe	28
PID 2112 wrote to memory of 2856	2112	rundll32.exe	28
PID 2112 wrote to memory of 2856	2112	rundll32.exe	28
PID 2112 wrote to memory of 2856	2112	rundll32.exe	28
PID 2112 wrote to memory of 2856	2112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_asf_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_asf_plugin.dll,#1
  2⤵
  PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads