e315b6c1144c05f8031cc752ec6fe84864f004e995476b6354abe5a805544347 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Codecs/atrc.dll
Size

76KB
MD5

143c1b061c29e8e6da3223591561837d
SHA1

e7542e2668e69ef8f159a7f2e7207d7552b4fb74
SHA256

98bc8d1425b7e2ae944074cab85f1b75ac86f4243420e088e0f1685009107a8f
SHA512

df8299935f8401368af7606a544213fd0662c67aed6819d0ee29e9266fc51349b08990fbf5a1a7a95eb09ad73173123b31d0f0bcacae852640adf5934451497e
SSDEEP

1536:yiIYskdn7pp5XIHvU/zTnw/unZ+NQvExk:DInap5XOU/vAIZpvEO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2936	1652	rundll32.exe	28
PID 1652 wrote to memory of 2936	1652	rundll32.exe	28
PID 1652 wrote to memory of 2936	1652	rundll32.exe	28
PID 1652 wrote to memory of 2936	1652	rundll32.exe	28
PID 1652 wrote to memory of 2936	1652	rundll32.exe	28
PID 1652 wrote to memory of 2936	1652	rundll32.exe	28
PID 1652 wrote to memory of 2936	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Codecs\atrc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Codecs\atrc.dll,#1
  2⤵
  PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads