4e68a591b4ed8ffe693619f7d98b7af388357eaf2d8005cf15b3fb5697fe69ce | Triage

Analysis

max time kernel
95s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 21:41

Sharing

Report Analysis Logs

General

Target

AudioCodec1.dll
Size

88KB
MD5

457dc4b86e997fa740108c1d1e623919
SHA1

fbbe40f68cd4228d239b4dc78e04a194387d5326
SHA256

71b817c4a5fcf8c77932c2c3f6937d1a0be55817ec31ef0e3c84bb846d0038cd
SHA512

4c38d6ab1563ace34d53ebf000d9e8d91636d78c2f697acfcf80ec465442f850e91604893e59b9d1076cae0bac4a83a4bfb54b18659b3648d9b4c70fc4e78de8
SSDEEP

1536:ne+OUST7CZjls5ZYqPBFrVkM32BqB8LsHxmQD6aOOOLAstp:eaST7CZjlsrYIl32BbrQD6a+t

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1476	1048	rundll32.exe	43
PID 1048 wrote to memory of 1476	1048	rundll32.exe	43
PID 1048 wrote to memory of 1476	1048	rundll32.exe	43

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AudioCodec1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AudioCodec1.dll,#1
  2⤵
  PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads