c92a121ec9829988f3b22328470df3d548f03a3970335694b50206676afaeb7e | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 07:36

Sharing

Report Analysis Logs

General

Target

publish/avutil-57.dll
Size

754KB
MD5

fd106a111eeede51ff8301d95f19795d
SHA1

907418267dcf1e144a527d951886910954f44f59
SHA256

fe9316238d1b58c98b4165b2b9831031e097c9b2ce2f1577cff842e53c6a722e
SHA512

f4b16b09b768889948245917d4e1cb85fdc2a982ad2c2939bb4739c5c4bae21f6fd624a913eb51612ed3f1d940efc69d5a503c1b7a31d4b2d8cc3567c7bb646b
SSDEEP

12288:mEdtaT+GvLhR777Zm02MCKwmR8fGixY6YYaEYiSf:mEdtaT+U3PQ0fwmR9i2ME

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2352	2336	rundll32.exe	28
PID 2336 wrote to memory of 2352	2336	rundll32.exe	28
PID 2336 wrote to memory of 2352	2336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\avutil-57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2336 -s 96
  2⤵
  PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x000007FEF65B0000-0x000007FEF6783000-memory.dmp

Filesize
1.8MB

Download