Resubmissions

08-05-2024 18:47

240508-xe74fahf4y 7

08-05-2024 18:39

240508-xamlyabh63 7

Analysis

  • max time kernel
    144s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08-05-2024 18:47

General

  • Target

    opencv_ffmpeg320.dll

  • Size

    15.7MB

  • MD5

    f081abd9d6ca7e425d340ce586f9c090

  • SHA1

    7cf57b7e8ffc6fe9ef183bb2944062814000ed36

  • SHA256

    c2573fbeb40156436ab64e8bf3df960bb8b237001b7a1402086b9714afb6d72f

  • SHA512

    ed00878d52ae072fc357cf4b8b25a8e76bcc678df1d6a163ddbe9a0589222ac06965d63b8747d92953d227301ce8f740c436582de281b592b1a00f42510c0b5c

  • SSDEEP

    196608:QCa2sOybspcrhVA2VooSZp8t8uF7jou83iAq/JMNjMDastAXZpxVy+oPkGZgqf4f:pQAj+Vt61AsEKeuXkpfQ

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\opencv_ffmpeg320.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\opencv_ffmpeg320.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 248
        3⤵
        • Program crash
        PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2040-0-0x0000000069B80000-0x000000006B298000-memory.dmp

    Filesize

    23.1MB