d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911 | Triage

Analysis

max time kernel
143s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:51

Sharing

Report Analysis Logs

General

Target

MediaCoder/codecs/MACDll.dll
Size

188KB
MD5

c701e21de1c74a3679fa64f29aab6e1e
SHA1

69e41b4d087c6b5d11a66913c915fe26ccabcb1c
SHA256

f76f21e808983f48d64587c05b5fcc35529d9581028522f79e46b35d85a56285
SHA512

66bfbfb997c1f73665084be0e6e1f646af49fc496ca64347e924c55b155a8d145dd8a70fbe20113f6ba8fc19076cefc75f27e10a334954d6bbec41c7d52d1c86
SSDEEP

3072:SzMlfO3xucXoLrbt+TppuVbmzYkbqydSDEbazkGBs:SzXBrerb4AbmE0fdSZLs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4632	3804	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3804	4644	rundll32.exe	16
PID 4644 wrote to memory of 3804	4644	rundll32.exe	16
PID 4644 wrote to memory of 3804	4644	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\MACDll.dll,#1
1⤵
PID:3804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 600
  2⤵
  - Program crash
  PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3804 -ip 3804
1⤵
PID:1968

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\MACDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads