54ba841477c4699c23f3770e5eee79633efa40401e2680cfefec60c19e2c98a6 | Triage

Analysis

max time kernel
150s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2024, 20:04

Sharing

Report Analysis Logs

General

Target

jre/bin/gstreamer-lite.dll
Size

502KB
MD5

8d0ce7151635322f1fe71a8cea22a7d6
SHA1

81e526d3bd968a57af430abb5f55a5c55166e579
SHA256

43c2ac74004f307117d80ee44d6d94db2205c802ae6f57764810dee17cfc914d
SHA512

3c78c0249b06a798106feaf796aa61d3a849f379bd438bf0bb7bfed0dc9b7e7ea7de689bc3874ed8b97ff2b3ba40265ded251896e03643b696efdbf2e01ac88c
SSDEEP

12288:Y5JbfdT5NYGe8m51QSWvopH1kdMDbA2ZoNnYX:Y5JV7eB3KopvnAe2YX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4868	3388	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3388	1936	rundll32.exe	81
PID 1936 wrote to memory of 3388	1936	rundll32.exe	81
PID 1936 wrote to memory of 3388	1936	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\gstreamer-lite.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\gstreamer-lite.dll,#1
  2⤵
  PID:3388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 580
    3⤵
    - Program crash
    PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3388 -ip 3388
1⤵
PID:3528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads