0cc54e69016e3d5a80e229c768ac37a02aea3a973a5447593c0132281e383942 | Triage

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 14:16

Sharing

Report Analysis Logs

General

Target

libvlccore.dll
Size

2.7MB
MD5

5d771e7016f0de7577e6d16b34f41a46
SHA1

5f55f2399782605a4c65949badd002b92d65d2bd
SHA256

59f1f408f6bc0c6a787d783f1d4a297fc2670a9c5cbe5eb30dba8c97adc1bd43
SHA512

4def63c1b31c28f8b0f5404b036893a9f939853573f0dd91e913b9e7bf96fa1745ff1f3403d22f8a4d26ad117bee4b75f1b22e1064e2bec72b408cf35338c958
SSDEEP

49152:mJIelavWUnyHcTP4lnBAUZLY6sEZGaXBuQQ9e7:z48yhnBAUZL3t

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2904 wrote to memory of 2972	2904	rundll32.exe	WerFault.exe
PID 2904 wrote to memory of 2972	2904	rundll32.exe	WerFault.exe
PID 2904 wrote to memory of 2972	2904	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlccore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2904 -s 120
2⤵
PID:2972

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2904-0-0x000007FEF6220000-0x000007FEF64D4000-memory.dmp

Filesize
2.7MB

Download