d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911 | Triage

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:51

Sharing

Report Analysis Logs

General

Target

MediaCoder/codecs/MACDll.dll
Size

188KB
MD5

c701e21de1c74a3679fa64f29aab6e1e
SHA1

69e41b4d087c6b5d11a66913c915fe26ccabcb1c
SHA256

f76f21e808983f48d64587c05b5fcc35529d9581028522f79e46b35d85a56285
SHA512

66bfbfb997c1f73665084be0e6e1f646af49fc496ca64347e924c55b155a8d145dd8a70fbe20113f6ba8fc19076cefc75f27e10a334954d6bbec41c7d52d1c86
SSDEEP

3072:SzMlfO3xucXoLrbt+TppuVbmzYkbqydSDEbazkGBs:SzXBrerb4AbmE0fdSZLs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1696	1888	rundll32.exe	28
PID 1888 wrote to memory of 1696	1888	rundll32.exe	28
PID 1888 wrote to memory of 1696	1888	rundll32.exe	28
PID 1888 wrote to memory of 1696	1888	rundll32.exe	28
PID 1888 wrote to memory of 1696	1888	rundll32.exe	28
PID 1888 wrote to memory of 1696	1888	rundll32.exe	28
PID 1888 wrote to memory of 1696	1888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\MACDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\MACDll.dll,#1
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads