4e68a591b4ed8ffe693619f7d98b7af388357eaf2d8005cf15b3fb5697fe69ce | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 21:41

Sharing

Report Analysis Logs

General

Target

AudioCodec1.dll
Size

88KB
MD5

457dc4b86e997fa740108c1d1e623919
SHA1

fbbe40f68cd4228d239b4dc78e04a194387d5326
SHA256

71b817c4a5fcf8c77932c2c3f6937d1a0be55817ec31ef0e3c84bb846d0038cd
SHA512

4c38d6ab1563ace34d53ebf000d9e8d91636d78c2f697acfcf80ec465442f850e91604893e59b9d1076cae0bac4a83a4bfb54b18659b3648d9b4c70fc4e78de8
SSDEEP

1536:ne+OUST7CZjls5ZYqPBFrVkM32BqB8LsHxmQD6aOOOLAstp:eaST7CZjlsrYIl32BbrQD6a+t

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2188	2620	rundll32.exe	8
PID 2620 wrote to memory of 2188	2620	rundll32.exe	8
PID 2620 wrote to memory of 2188	2620	rundll32.exe	8
PID 2620 wrote to memory of 2188	2620	rundll32.exe	8
PID 2620 wrote to memory of 2188	2620	rundll32.exe	8
PID 2620 wrote to memory of 2188	2620	rundll32.exe	8
PID 2620 wrote to memory of 2188	2620	rundll32.exe	8

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AudioCodec1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AudioCodec1.dll,#1
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads