privateloader | b1707825c0f2fde7bfdbb5f4a4cef4002a935b2c9edfa93f512127f430cfbdd0

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240215-es
resource tags

arch:x64arch:x86image:win7-20240215-eslocale:es-esos:windows7-x64systemwindows
submitted
04/05/2024, 14:48

Target

avcodec-59.dll
Size

67.3MB
MD5

5398be059d32fc99ae35a469bcd55255
SHA1

dd4a6154a185e1fe24a4ce024179441ec8a44194
SHA256

5023347055e0dc62d02d6e1d557832d61834fda26da11f43ea7eb04f224ed92d
SHA512

c0f6b782030c8bd4da9bde690192a826f4eb9bb027918bdb81b1a91195e22d2a1e2475767f250cc4e6cd23e5a21650030765ec769acb8399f330172200251f94
SSDEEP

393216:rh5v+6bVVGcq20EPrEStqiJ0WOf5dd0EhRCe9lBZkvxMXHthsT6ltmPshdPPRX29:r7HK20+RJ8jd0EjCilb+MXc4Ph4dH3

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2908	2892	rundll32.exe	28
PID 2892 wrote to memory of 2908	2892	rundll32.exe	28
PID 2892 wrote to memory of 2908	2892	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2892 -s 180
  2⤵
  PID:2908

memory/2892-2-0x000007FEF7340000-0x000007FEF73E8000-memory.dmp

Filesize
672KB

Download
memory/2892-1-0x000007FEF66D0000-0x000007FEF68D3000-memory.dmp

Filesize
2.0MB

Download
memory/2892-0-0x000007FEE22A0000-0x000007FEE71A9000-memory.dmp

Filesize
79.0MB

Download