ed5fe5eb0d0146db50d8848052a4a9177c50ea00c51471f4489f1327370133d4 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 09:33

Sharing

Report Analysis Logs

General

Target

Total Video Converter/FlashPlayerControl.dll
Size

400KB
MD5

27c8cbe1eac9bcc4be61e16d90f607da
SHA1

05ac4424b2d708cd1055485a0346ca9cf9fa0be7
SHA256

e3da76d2468431a616706e7be0c6311b82254ed65cbd81b243ddfd003158493b
SHA512

299908a3f948f000ee08b1042904404e5a553d996b2eaba65e7ee0316895cf9276165953eb5ea5bc3ca2eb89e59025811a93079815d729004609b27e5839906c
SSDEEP

6144:UExHRSCS+LZ7nUjlnFSlmjqkvkjTOFtn:JHRLSi6+mjRkf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1372	952	rundll32.exe	28
PID 952 wrote to memory of 1372	952	rundll32.exe	28
PID 952 wrote to memory of 1372	952	rundll32.exe	28
PID 952 wrote to memory of 1372	952	rundll32.exe	28
PID 952 wrote to memory of 1372	952	rundll32.exe	28
PID 952 wrote to memory of 1372	952	rundll32.exe	28
PID 952 wrote to memory of 1372	952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\FlashPlayerControl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\FlashPlayerControl.dll",#1
  2⤵
  PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads