8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 16:42

Sharing

Report Analysis Logs

General

Target

scripts/z3DAudio.dll
Size

5KB
MD5

8976275732d79fae961961f7ecf83228
SHA1

84de0fed10442fc93e5702bb8e20c96f54771fc1
SHA256

8a8604718bd6095c55b1db6a76df37e95d8f56abf07290441534cacf49c11059
SHA512

c5d064341451f058a63704c0518439bdb81568f4160bcef056ef6e2ed311c8caa1a3a86e5bcb04b3989ea64878020cd0cfed83176ee5d87baa78c40d220df155
SSDEEP

48:ytY7S4x1HEF3p0JvBSFjQA/sFeGgK/yWYjtb7C1iuXYacOI9XtgjT:iYdgKdB3A/3K6pt/mI9dM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\z3DAudio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\z3DAudio.dll,#1
  2⤵
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads