80abc14026ede9a9d0b601f925dfed172e6443eb20c63786866760395b1cb79b | Triage

Analysis

max time kernel
162s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 17:01

Sharing

Report Analysis Logs

General

Target

avcodec-53.dll
Size

4.0MB
MD5

7d6ea6e35b790fa4c7523befb59695f6
SHA1

7a7e31579bb4d1973f4a82f0ffa839a73749c6e6
SHA256

93fd9cf4ca4a9045574ec8452597ac520c33a25aef3d131fde34c4ddf2a99adc
SHA512

eafc7a1a3388e44d44a2eb58e05a24204391dbb36184c2be738ca020cfde9222587a0427b4f4b0472175bc589858e49d8dc5e388b198203a81874a6189247529
SSDEEP

49152:HDss000lpr3bQV5LfjWcXVqkxIV2WwTA1xEjggnFb9mHc4KJ8r3L+06DqrH:3vjfpxIV2WuA7gnFjp06

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2532	2616	rundll32.exe	30
PID 2616 wrote to memory of 2532	2616	rundll32.exe	30
PID 2616 wrote to memory of 2532	2616	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2616 -s 84
  2⤵
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2616-0-0x0000000065EC0000-0x00000000665F3000-memory.dmp

Filesize
7.2MB

Download
memory/2616-2-0x0000000062E80000-0x0000000062EB5000-memory.dmp

Filesize
212KB

Download
memory/2616-3-0x0000000068B80000-0x0000000068BB0000-memory.dmp

Filesize
192KB

Download