e38025d820f932697f2d3429e7543d9089bfd129d144aeb50b0967aa7dd8a3fd | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 07:11

Sharing

Report Analysis Logs

General

Target

Plugins/in_avi.dll
Size

66KB
MD5

5ec628ffd79c43236808eceff6cbad5c
SHA1

bbb97114c930ba46a633bc3b507b6961ce4b466d
SHA256

10fb2053778502d12c1b62212dada26555b6a23a6bea5b51cf05d1d9aa8b51a0
SHA512

6b07f813642b1777c872f92b2cdd40c91d6b6f281054d69e9b3549d9a266c93c8d642ec3992881e1c49ba07b8f79443d82a5c99ec1b96c08d44f79c3619be9f6
SSDEEP

768:AKZ5oXbytsYa4ou8AZLK+SF/bXQZrKJ1hAtJUpXDF5faPpevMOK6lDdFzH:9xtsL+SbAKfrfQpQMOK6lD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2052	2028	rundll32.exe	28
PID 2028 wrote to memory of 2052	2028	rundll32.exe	28
PID 2028 wrote to memory of 2052	2028	rundll32.exe	28
PID 2028 wrote to memory of 2052	2028	rundll32.exe	28
PID 2028 wrote to memory of 2052	2028	rundll32.exe	28
PID 2028 wrote to memory of 2052	2028	rundll32.exe	28
PID 2028 wrote to memory of 2052	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\in_avi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\in_avi.dll,#1
  2⤵
  PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads