27c1008f283ea779e96e487038c4f0a34c355439cb97790998df4a178baaa433 | Triage

Resubmissions

20/03/2024, 13:26 UTC

240320-qpv4asac21 10

19/03/2024, 15:20 UTC

240319-sq7vlafb95 10

Analysis

max time kernel
595s
max time network
366s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/03/2024, 13:26 UTC

Sharing

Report Analysis Logs

General

Target

libvlc.dll
Size

1.5MB
MD5

0a95072b247d25671784f7904ff96c2b
SHA1

7eb59ffc0798cfddbb81ab606778c361a223f3ac
SHA256

e05a7b47a4ddf8e85c1dd406fcf62d4cd3de7208212a6d0e9360c06e1acfc1bf
SHA512

b00f8e2b28dde8a88a923062c57cd727cceac6bb6db1e61b6600c3ed6dbf7a5559a673ea5e16bf4b538325b82137bd39c94765d8987210d9b63078cc571cc73f
SSDEEP

24576:CZNTqhx99zSBbP8N2xV1NLSswDgS3j4Hbo:MTqh39zs4yygS3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2156 -s 156
  2⤵
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x0000000074900000-0x0000000074A8D000-memory.dmp

Filesize
1.6MB

Download