4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 11:50

Sharing

Report Analysis Logs

General

Target

avcodec-58.dll
Size

5.1MB
MD5

4c9541d620fa01a88096ba010cb15a45
SHA1

d3f5e6fe39a11972b86baefef151f57cea364b60
SHA256

fd7d1a0cfb17b20e4e7aa422cd769aa6f84b2fdad1ae32679da0442f8efcd0da
SHA512

9654e98a0d1305ad83281a1499a4d1e64954c7cd10d164b5b1aebc434fe0a9bdbe0a97f576779b450054760e7e6284dce60461922f6d5417d240f03410bf9133
SSDEEP

49152:FL0uNOto7fbxpUJ8wdb+vJGpHgrqfjVJfU7mggp9N+ui684YgSlFuqMHIuZfvsDg:Z6txsoTp2Fmj1MET

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2136	1192	rundll32.exe	28
PID 1192 wrote to memory of 2136	1192	rundll32.exe	28
PID 1192 wrote to memory of 2136	1192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1192 -s 124
  2⤵
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads