4e68a591b4ed8ffe693619f7d98b7af388357eaf2d8005cf15b3fb5697fe69ce | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 21:41

Sharing

Report Analysis Logs

General

Target

AudioCapture.dll
Size

72KB
MD5

991ff7d5b4386018cc480fc31c40f534
SHA1

8472f3807cee65313ff9fea252c277b7902d12cc
SHA256

6df89d5ebb96e5e51c4e763eb5fb2cedd87d091ac3a9cddea303558cf8c5fcd8
SHA512

ba6ae363991144665e7e353b1c9c415c856277c9d69b4148b372b43e0d53dd294138e9ee88425062bbc7937971c0312c4c7b35f68ed41efe8027a7d34fe00f77
SSDEEP

1536:z88/fFUb9e0ytzUa/2z/lMaywUeE/OktDug3E:T/29+ho6yiOktDug3E

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AudioCapture.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AudioCapture.dll,#1
  2⤵
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads