7b774eecbb5682141590d16a1464ee224dab94298e0c80b42ae27e317df754b4 | Triage

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 20:22

Sharing

Report Analysis Logs

General

Target

vlc-1.1.11/Plugins/liba52tofloat32_plugin.dll
Size

64KB
MD5

e0d81e1d14a9304a528320272848a550
SHA1

9bb312fec98169ed5e727f721254eca36b9d08d0
SHA256

1a719281d8d5828c85f4dce2c4761ae81db56128b8156f73c0e33958022fbd53
SHA512

227276b342104a0ed4a0037d5740af89a197232026690e6faa3cf3d2d9019ec63659b37e4bd3978b8988779b8c192aff0170ebd86a8913d15d8fe85c53db1961
SSDEEP

1536:0iZ8DS/nqz2I1+AsMaK6gulQR+VL9czog:07+fm24V6guuR+VL3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1688	1592	rundll32.exe	89
PID 1592 wrote to memory of 1688	1592	rundll32.exe	89
PID 1592 wrote to memory of 1688	1592	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vlc-1.1.11\Plugins\liba52tofloat32_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vlc-1.1.11\Plugins\liba52tofloat32_plugin.dll,#1
  2⤵
  PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads