28ac79ffdd5e6123e102acd5b4c6130b29d419b247548413cf6fc87549f4b025 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Framework-R2R/Acustica/Framework/NeAsBr01b0.dll
Size

12KB
MD5

da08ea5450c5cba394522ccb282780b1
SHA1

76ea084e1f63fbd69ce209bea55ff6cbb67e316e
SHA256

d7b97e4311aa08ba261ee4c57280b414b188cc98f8fd59ad3d1710e7c62a301f
SHA512

ab77ce1165d5ad74c7ee38ccd02e8421870028a51d05fe59125b6994c9dc60457302fd4f7e4b689af72d1e1d4ee45b7cb00d3405ca8e95810cfa9238b7b793c2
SSDEEP

192:xA7uIIf5FbS2lLyCGPwaILbKXBQJctzP3:S7uIIvb1zaIHKXwc5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Framework-R2R\Acustica\Framework\NeAsBr01b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1924 -s 80
  2⤵
  PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads