33af558afbb7fe3d12f3b0e0fc0c7338ffd747e67e3a6048e7d6b6b33b21d549 | Triage

Analysis

max time kernel
140s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 05:16

Sharing

Report Analysis Logs

General

Target

vorbisFile.dll
Size

18KB
MD5

fbe34f162166fea391a3f74ff4701a25
SHA1

37fab718af40733703c04e79979578cd565b87d6
SHA256

a31cbc43a80a6737137500516b6e1973f47e93c24c8599e007f5272747ff0548
SHA512

9badefa03be1021ae08b613fbc6ac075bff7d7e9a19b1a0e05b04018cbd1a4bbd434efb0c5990b7a5cb0a54882f641423a8141575e90c77f815fb444559aa4b5
SSDEEP

384:YE+F6DSqxyEvlDrcy4Eht3Wdf9nVmXBEesO9ucI:qF1qcEvlPcyJhtG3n4KeNuc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3412	3664	rundll32.exe	83
PID 3664 wrote to memory of 3412	3664	rundll32.exe	83
PID 3664 wrote to memory of 3412	3664	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vorbisFile.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vorbisFile.dll,#1
  2⤵
  PID:3412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads