0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c | Triage

Analysis

max time kernel
93s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 00:13

Sharing

Report Analysis Logs

General

Target

components/foo_dsp_ssrc.dll
Size

194KB
MD5

7b7ba4f11f583b1d51f6a0ee8be939d9
SHA1

00fa108bfa993146a75dbf0f96b0658d50df5304
SHA256

a39a969ff2048a09618a53e98545bb28443ba57dde683ab4de001ea1ee571030
SHA512

686d90f544a5bd8a67ac6965f84f16577e65269f6a16a08ecc39cc74545bce5952681962d1b04513e0999efb1aaab08d930ba3ce5bcf707f4b9d6442e70c7a58
SSDEEP

3072:zabUUkvt/4LuRxQScftbCx3rxZ/irziG1RAg0Fu1+X5mjTtB1D:Ghkvt/4a1PZIDAO1Ge1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 5024	2016	rundll32.exe	87
PID 2016 wrote to memory of 5024	2016	rundll32.exe	87
PID 2016 wrote to memory of 5024	2016	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_dsp_ssrc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_dsp_ssrc.dll,#1
  2⤵
  PID:5024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5024-0-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download