4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 11:50

Sharing

Report Analysis Logs

General

Target

avdevice-58.dll
Size

742KB
MD5

249609ca649419f2bff0bd551f8f4307
SHA1

7a10c99216ef7ad0a726cb5d987fb94a5fd68cd9
SHA256

28ab8d61b11fd59d4140bbf840c2c6d122849c659fbfd55a94591ffac93e1820
SHA512

5ca215f007803c7b76fb1c59ba605be7b178349451ba1e85cf04189b69f82b70ae9ea6a3d904a574fe6c89228fc3ec4a4c411b77f578ee9a3e56f4f7481e002b
SSDEEP

12288:Ot+jc50Dcgc0uqCfktrocWGueTp8HWqdIKDGMB8HPPf1Hvkg:OscRKMUvph

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avdevice-58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 124
  2⤵
  PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads