8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a | Triage

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 11:05

Sharing

Report Analysis Logs

General

Target

mux/libmux_avi_plugin.dll
Size

49KB
MD5

1ef79e66e5ee7c77a404d831b764f7a5
SHA1

3ce795db8d25de43d46a22d3864effe1b4a0d23f
SHA256

c2129d0e834bcfd98498df1a63dd904249756492039f2b99efd7f2224ff19759
SHA512

9c020972dead4e1f0d1567b1c66daa4f1e71dcfdbf399ab2642647a89b936fbc588617decde8980c857f364b9536accfd1cbb9e60bcda0f36c064249a7eb51cd
SSDEEP

768:r0Z4MQ5Y9e1mCnTx0TkMR5eXCXBAxGo5nDGFhTchDGFh2:Q6qI5W5Eu+r2cF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2124	2200	rundll32.exe	61
PID 2200 wrote to memory of 2124	2200	rundll32.exe	61
PID 2200 wrote to memory of 2124	2200	rundll32.exe	61

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_avi_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_avi_plugin.dll,#1
  2⤵
  PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads