8bb79293e59e4fbd16f770848d90c6958c4f37b945e2c18d3739bbe7520f33a3 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:08

Sharing

Report Analysis Logs

General

Target

OpenAL32.dll
Size

462KB
MD5

ddf6fbb5ccd9a62d74c516ea05d3ca97
SHA1

f161e49b42b1a23a3fb65e46f6744114e7a1a4e4
SHA256

64c7377a1a81e0d07465c14ab51b9cb123037b68cad02d67a5dbc232c04b43f0
SHA512

df43f5a7ee1c47017afa070277cde436a4faac5d65d27d084ca52d750af1ea7dd3b4851f08130502d93d7909d738e9faf832413805cbd9c08ebc4a1f2b53735e
SSDEEP

6144:fQf2w3wTC+/DJfmIxrn00L0W08OenGZl9CI5M8RRgzAOn9m:fQdYVmICZZl9C2M8RRQbm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2964 wrote to memory of 3068	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 3068	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 3068	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 3068	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 3068	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 3068	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 3068	2964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OpenAL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OpenAL32.dll,#1
2⤵
PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads