66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2 | Triage

Analysis

max time kernel
1376s
max time network
1161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Sharing

Report Analysis Logs

General

Target

media_dll/swresample-0.dll
Size

116KB
MD5

e515dd5c5bba7522e248201c90619abb
SHA1

37641d1db8a0bb4463a5a144557062fbec7271b7
SHA256

2e9f4ed96d61072994dde8ccd14fe71217d161ad83a097d724d8d7410d4d8da2
SHA512

0878cfadf92c73951cf1f3e38684bdeb49abf58c4ec62252570290af7f2e20425b63c8c7c0832d7c30798a035234154110f9da2882c8b5557530e2814c12d3a7
SSDEEP

3072:bV5RGv3C5dDlBg0QoHg2L+LWGioaDuxd7kyIR:xjGv3mouwWGioaDuH7k3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4644	4184	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4184	3388	rundll32.exe	88
PID 3388 wrote to memory of 4184	3388	rundll32.exe	88
PID 3388 wrote to memory of 4184	3388	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\swresample-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\swresample-0.dll,#1
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 616
    3⤵
    - Program crash
    PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4184 -ip 4184
1⤵
PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4184-0-0x00000000707C0000-0x00000000707E2000-memory.dmp

Filesize
136KB

Download
memory/4184-1-0x0000000066D80000-0x0000000066DC1000-memory.dmp

Filesize
260KB

Download