5a4be9e92cf84b6fdedef3623c4fc76a9a239e98f88c0c4368bbb72caafdda03 | Triage

Analysis

max time kernel
143s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 11:47

Sharing

Report Analysis Logs

General

Target

avcodec-57.dll
Size

27.3MB
MD5

28c3d3035ff3b9216a77016cf23205dc
SHA1

19683f75253daba16c626f43ee43372b8d7bcdf3
SHA256

bd5f83ab365e1c9b26742fb2d523bb174acf547f9a1ae73f8a6cc5cf2fc97b9f
SHA512

87b4b8e642785942db51593a9a162f641e672542da999796e1763f3f41aae5f8195577b5e20c993c6425449512edad71222dd42e9a31b6130d93c70b3e2aaf70
SSDEEP

196608:eooaALQtm3+f1mZEEtBY1Ep1O9+WX6zNPgEvQ1BC8aJpPuCnVLYL:xDMX/BA9+y6zQBC8aJpzJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2016	2216	rundll32.exe	28
PID 2216 wrote to memory of 2016	2216	rundll32.exe	28
PID 2216 wrote to memory of 2016	2216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2216 -s 96
  2⤵
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-0-0x000007FEED2E0000-0x000007FEEF68D000-memory.dmp

Filesize
35.7MB

Download
memory/2216-1-0x000007FEF7E10000-0x000007FEF7EB2000-memory.dmp

Filesize
648KB

Download
memory/2216-2-0x000007FEF72C0000-0x000007FEF7351000-memory.dmp

Filesize
580KB

Download