8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 11:05

Sharing

Report Analysis Logs

General

Target

mux/libmux_asf_plugin.dll
Size

60KB
MD5

420100cead6a6ae3d619e2cd4b7448f2
SHA1

b6e1ea9774d1ec269925c6d4fd46eeeff7f931c3
SHA256

5ac3c446bc787bac3c2c62559933970b3dc7fc7ad6ebe441838261b57a17a1b1
SHA512

9e207c57995fec461be8c7f221028a652d9762797d1b98132f70d4de50c1660c8742378457482f820f2282ae52e6270f46a9ed763fbd56ceb538e48d58b73eb1
SSDEEP

768:5uxLpzla9aotNVxA7xDjDNn0aVZI94e5i+XzDGFhcQDGFhmQH:Opl+aottmjhn0YG2Q6Q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4872	4112	rundll32.exe	85
PID 4112 wrote to memory of 4872	4112	rundll32.exe	85
PID 4112 wrote to memory of 4872	4112	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_asf_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_asf_plugin.dll,#1
  2⤵
  PID:4872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads