b219c036534453233322a674113c575f3bb374b2f3114012c72d4b5b5dcd8d9a | Triage

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:31

Sharing

Report Analysis Logs

General

Target

sox-14.4.2/libwinpthread-1.dll
Size

52KB
MD5

3077521e34ae5d1dc86a6edfb260f93c
SHA1

ca3ae87930b0ce3074126b7a1b9066ddcdfa65b6
SHA256

036af4b9aed20a6bd8b1993f2e0a4789c2ba555c00c0b2d72a6d6a6b8c13ef68
SHA512

a2db6f71e475eaa2b541ababec85a50c0c82e826146189be686394ad9967976d1c204b75fec23ec793faa8e003bff1c48f93ac9cc5914810a89eed2dee3898f7
SSDEEP

1536:bHtLkvhiCFHkMUtZ0Di1s4d+HimcY1uQ2H:bHGh5HkMUtZ0ks4dGimcY1X2H

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2420	2672	rundll32.exe	28
PID 2672 wrote to memory of 2420	2672	rundll32.exe	28
PID 2672 wrote to memory of 2420	2672	rundll32.exe	28
PID 2672 wrote to memory of 2420	2672	rundll32.exe	28
PID 2672 wrote to memory of 2420	2672	rundll32.exe	28
PID 2672 wrote to memory of 2420	2672	rundll32.exe	28
PID 2672 wrote to memory of 2420	2672	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sox-14.4.2\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sox-14.4.2\libwinpthread-1.dll,#1
  2⤵
  PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads