10a4cb7a2790344ded0513b288d0431967a44706a345f50d1b8fec8e244793d9 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

avutil-51.dll
Size

200KB
MD5

3d909daf2784bbab60e9bce4feffa91c
SHA1

b8cae33ae504e73786eb1b7a9bdc6a5d0a80a520
SHA256

39c888e4901f581841ef1bd1a41359e4c1dc70ace2b374f7c21a1021c9b7208d
SHA512

57a018ca50a71e4478f60d9090c23fefb758408f65c587bfaaad89c09da9bcf5121db7c02c9b0992e59952d2c80b951e2e264b82975cd7c258763dda8e81c825
SSDEEP

6144:x3erCTRwpLNGXUkF3xh0dPVsHB5STtyld:ilLNGrFhaEl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avutil-51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\avutil-51.dll,#1
  2⤵
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads