f59b9ff344d986ea37b2af26bd6bdf4bba7d004b0f6efd82cfb050dc8b2e94ef | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 10:54

Sharing

Report Analysis Logs

General

Target

Plugins/in_mp3.dll
Size

497KB
MD5

0c4432cf0070a8cec1b4f2978b1edd40
SHA1

7c290c761a0cc3c39bceca6a1d2512fddf117fcf
SHA256

798f594e0df9034b4b49888cb27638d130a23f1210368a857deb72518ede1221
SHA512

47b088fc3d77d1d82fd6ddb5b2a36e5f869a4701eb63135ae9db4c139e8383398bf2df0cd87d64a570e527592bb4976a4faf58d5da54290b7f3c98f09e567468
SSDEEP

12288:WrTdG62qGGC07C2aisji3E5fgP72AgyAe48w:WrTVfGGC07qe3RqAVAsw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2220	1424	rundll32.exe	28
PID 1424 wrote to memory of 2220	1424	rundll32.exe	28
PID 1424 wrote to memory of 2220	1424	rundll32.exe	28
PID 1424 wrote to memory of 2220	1424	rundll32.exe	28
PID 1424 wrote to memory of 2220	1424	rundll32.exe	28
PID 1424 wrote to memory of 2220	1424	rundll32.exe	28
PID 1424 wrote to memory of 2220	1424	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\in_mp3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\in_mp3.dll,#1
  2⤵
  PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads