6a0664da0332aa8f4428914ba6aff37506fd239776a881e6d24f1cf5b60cbb70 | Triage

Resubmissions

24-09-2023 15:33

230924-szdm4shh59 3

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
24-09-2023 15:33

Sharing

Report Analysis Logs

General

Target

libcodecs.dll
Size

1.8MB
MD5

22379aca080abf93f58ef661711690a9
SHA1

5bb7979e671f8843aeb58f70474f15a545a7bc43
SHA256

fdc28be3baf7dcd4760795ba9a3724bd4e4940e1cb123b85e8567efe3be2b0d6
SHA512

a188242ed1d2c660167d09dc3bc1532efcb67dfaeb423b179b0f869b8dee79b1daccdadd2a2d502e8d47cf854c561e1c57944e4533c1f5b57223474db3d8893b
SSDEEP

49152:cQDVhm9VDhHqfpn9H+eNXkrPVx5ZJVdpcnFdEXhA:ct9V9HqBn9H+eNXkrt7Onzf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2032 wrote to memory of 2416	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2416	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2416	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2416	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2416	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2416	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2416	2032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcodecs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcodecs.dll,#1
2⤵
PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads