4e68a591b4ed8ffe693619f7d98b7af388357eaf2d8005cf15b3fb5697fe69ce | Triage

Analysis

max time kernel
131s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 21:41

Sharing

Report Analysis Logs

General

Target

MediaPlayer.dll
Size

76KB
MD5

80bfd104899973eb776e2a0506317d6a
SHA1

d2211875a4b1f5fb6a89ad20b33176238824ff0b
SHA256

00a32bae7adacae1fb5c17a6e1650536931c4a9d4f0e1cf06c2928e3b0ea7056
SHA512

2b4b0fa2a0cc6a119631fa50cbe14e73a8173996a61573d694e39c876a370b21df72a9693d3adfe4d625fdde777d77fec8bd0f228b2e820a6364e1fe385e24d7
SSDEEP

768:ofqqBs8Ure35NRUm6oc2COI97NQBJh7BbvE5U2aeO0x26kSuOkc:qqqBsrClL6j2COI97q7Nvv2afxS3n

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3448	560	rundll32.exe	87
PID 560 wrote to memory of 3448	560	rundll32.exe	87
PID 560 wrote to memory of 3448	560	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaPlayer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaPlayer.dll,#1
  2⤵
  PID:3448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads