4d085c99ff295582f3aba758345adec2527f11841cdaa78f38fccd200c38167f | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 22:07

Sharing

Report Analysis Logs

General

Target

$PROGRAM_FILES/QuickTime/QTSystem/CoreVideo.dll
Size

100KB
MD5

f809ccc04b81db30b9d1419b1d9751dd
SHA1

165616ef13b728d0a2d266a9358608f0b41efc9a
SHA256

74b8c5fa7fe91d472bb7c388cbe387debdd3dc35c5b524cc7cddda7754c53a28
SHA512

2ad30a997be863fef322f51d805b03e405b6ac21654adfa3ac39188b89944310e90c2b75faf787296668d89da9d53adb38aaf6f149a50f5e7cf1d6f2cbe19ae9
SSDEEP

3072:XSh9wnK8ZmTHKQr67yxfl3yR6dZJV+l7/6PF:zKEmFligjo6t

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2940	2112	rundll32.exe	27
PID 2112 wrote to memory of 2940	2112	rundll32.exe	27
PID 2112 wrote to memory of 2940	2112	rundll32.exe	27
PID 2112 wrote to memory of 2940	2112	rundll32.exe	27
PID 2112 wrote to memory of 2940	2112	rundll32.exe	27
PID 2112 wrote to memory of 2940	2112	rundll32.exe	27
PID 2112 wrote to memory of 2940	2112	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\QuickTime\QTSystem\CoreVideo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\QuickTime\QTSystem\CoreVideo.dll,#1
  2⤵
  PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads