503be859e18644f602061532b7b20bcd23eec13630873dce1a0fb7f98ca742e8 | Triage

Analysis

max time kernel
54s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 02:11

Sharing

Report Analysis Logs

General

Target

media_dll/SDL-2.dll
Size

296KB
MD5

3ea7829589775f17f3b2bd13c646d2f7
SHA1

2f49dc36198c2db24293ec5b677340a159962438
SHA256

af5f2716f1669e09e362d6ce8d4878a162a521d2aafe1660199be574242d151b
SHA512

22649d9a216cd4f43bdeb4784bd6c1c4a3ebf99d73edbe4ff7a327d26a780dcd739c75692579ee12c1c516ca5845dabe41e81246e939583c27705fb8f0f636b8
SSDEEP

6144:uwGtZXn6NpaY+JOtOUm9ARogXSy5ZBYQcj8eKmzAlSQ:MzXn6paY+JOtOzGNiy5854L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1772	4704	rundll32.exe	84
PID 4704 wrote to memory of 1772	4704	rundll32.exe	84
PID 4704 wrote to memory of 1772	4704	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\SDL-2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\SDL-2.dll,#1
  2⤵
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads