8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 11:05

Sharing

Report Analysis Logs

General

Target

mux/libmux_avi_plugin.dll
Size

49KB
MD5

1ef79e66e5ee7c77a404d831b764f7a5
SHA1

3ce795db8d25de43d46a22d3864effe1b4a0d23f
SHA256

c2129d0e834bcfd98498df1a63dd904249756492039f2b99efd7f2224ff19759
SHA512

9c020972dead4e1f0d1567b1c66daa4f1e71dcfdbf399ab2642647a89b936fbc588617decde8980c857f364b9536accfd1cbb9e60bcda0f36c064249a7eb51cd
SSDEEP

768:r0Z4MQ5Y9e1mCnTx0TkMR5eXCXBAxGo5nDGFhTchDGFh2:Q6qI5W5Eu+r2cF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2860	2576	rundll32.exe	28
PID 2576 wrote to memory of 2860	2576	rundll32.exe	28
PID 2576 wrote to memory of 2860	2576	rundll32.exe	28
PID 2576 wrote to memory of 2860	2576	rundll32.exe	28
PID 2576 wrote to memory of 2860	2576	rundll32.exe	28
PID 2576 wrote to memory of 2860	2576	rundll32.exe	28
PID 2576 wrote to memory of 2860	2576	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_avi_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_avi_plugin.dll,#1
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads