f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:54

Sharing

Report Analysis Logs

General

Target

aacdec.dll
Size

88KB
MD5

47b44dfb02c26615e7ba763b61f7a831
SHA1

0295bc07aad6e3bb568a976ca03faa1f5644bf7e
SHA256

3d513795508b9b9ef2ef9d768bcb12f3cd78be811221dd70332dc249b660b4d1
SHA512

c548a90f4214aa6d8640e7c01b820edda71d5aa5f08fc9581f68fdfdeaaab25bded6ea22da1ebcd8e1b8dafea4e8557758db032a57dbae8be69e2fc3b4caab94
SSDEEP

1536:6sTOMcxf7jORaXLfK/lpbn/qVDbPSKTwKfCSGitiBYMEjhwrZDRZ9A:pTOMcxTCRaby///IPSfutt0YMEUDRzA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2112 2120 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2416 wrote to memory of 2120	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2120	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2120	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2120	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2120	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2120	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2120	2416	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 2112	2120	rundll32.exe	WerFault.exe
PID 2120 wrote to memory of 2112	2120	rundll32.exe	WerFault.exe
PID 2120 wrote to memory of 2112	2120	rundll32.exe	WerFault.exe
PID 2120 wrote to memory of 2112	2120	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aacdec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aacdec.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 220
3⤵
- Program crash
PID:2112

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...