8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 11:05

Sharing

Report Analysis Logs

General

Target

meta_engine/libtaglib_plugin.dll
Size

1.5MB
MD5

6a92321e8306a2b799600a316b913637
SHA1

99cb4474611bc1aa25d66aed5b73a09e041515cb
SHA256

07ee73eea28c05e8001df29e5ada15b56f88d14dd323cf184860cc41cd0de09b
SHA512

26feca601d3cb656fe5e582d1b6c6b3397f9ab54c1f802ef8dd24042481b3116f3ae9267e3933c39bce1a0cc8b31d930254ae0984c6d09d76575a1a35750d7ac
SSDEEP

49152:0qStMzXQQHyKW/10+Bg1nMpty4+PU46n2r1eNTI3:hStMUKO10+B2Mpty6wF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2904	1976	rundll32.exe	28
PID 1976 wrote to memory of 2904	1976	rundll32.exe	28
PID 1976 wrote to memory of 2904	1976	rundll32.exe	28
PID 1976 wrote to memory of 2904	1976	rundll32.exe	28
PID 1976 wrote to memory of 2904	1976	rundll32.exe	28
PID 1976 wrote to memory of 2904	1976	rundll32.exe	28
PID 1976 wrote to memory of 2904	1976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\meta_engine\libtaglib_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\meta_engine\libtaglib_plugin.dll,#1
  2⤵
  PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads