b491e40b713b3d7c61c662b01d77ce7551d55894769a693be885b87c050bfaac | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 12:42

Sharing

Report Analysis Logs

General

Target

xvidcore.dll
Size

664KB
MD5

5ccabad90c1b3ed50238c5c8e9e5760c
SHA1

a0572e320aa39fbfc98ac177e789ba15a970ef6c
SHA256

b491e40b713b3d7c61c662b01d77ce7551d55894769a693be885b87c050bfaac
SHA512

8bb35f271c72e24688aed1b052704512b745a7f0e16aa509065f146719e4f3a07b7ae8a92309677505069d53e8f31ea9f88e01517041cfc403bdb2a2d938412c
SSDEEP

12288:IeZt/ZHpJn959MpLO73yrFAq9+gQy+gQOJa4bD08Yr+T2Zt5GZgn:IeZ1hpJn9gLO73aFbFJa4bD08Yr+Titb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2748	1876	rundll32.exe	28
PID 1876 wrote to memory of 2748	1876	rundll32.exe	28
PID 1876 wrote to memory of 2748	1876	rundll32.exe	28
PID 1876 wrote to memory of 2748	1876	rundll32.exe	28
PID 1876 wrote to memory of 2748	1876	rundll32.exe	28
PID 1876 wrote to memory of 2748	1876	rundll32.exe	28
PID 1876 wrote to memory of 2748	1876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xvidcore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xvidcore.dll,#1
  2⤵
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads