7de68704bad0f0ecc0a815428043c3eed923d5e93c02df4ee593cf95db334705 | Triage

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

EOPAudioRecorder/RecordAudio.dll
Size

234KB
MD5

48468b252c2fdc9f112693e57084f85c
SHA1

89807e70d6c852db4806f6b1e037bc0403996dfb
SHA256

547d814ff4d3838c01eed83acc1cf5220cefaa9a3e1acbdde67ec43ee1890522
SHA512

08e9a90b2f214d2b2ec4d14867680d2153679bd8038d190b8a3c788d3bee652565cd4cc5eb0dc4f908288cdd5da834bb4541e5dec574c719ab8b7113fef208be
SSDEEP

6144:AUa7rNXASqpparRA+Gh1Uj1dhAQBqZiiEL:AXAnAGh1Uj1dhAQBqZg

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
228	2816	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 2816	368	rundll32.exe	82
PID 368 wrote to memory of 2816	368	rundll32.exe	82
PID 368 wrote to memory of 2816	368	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EOPAudioRecorder\RecordAudio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EOPAudioRecorder\RecordAudio.dll,#1
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 640
    3⤵
    - Program crash
    PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2816 -ip 2816
1⤵
PID:500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads