cb6bb334e15093e624d5a39cac6e119515bc961ea5a1232ab4aa1f6930f21584 | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 19:18

Sharing

Report Analysis Logs

General

Target

audio/AudioPlayer.dll
Size

98KB
MD5

000577144340d9bb127a2b6af6681e02
SHA1

59d2095d6ae329193b7349491cc27762b440858d
SHA256

3d15f7ca60c98a6162445ea130c36bf84c18470254c5b82dea5430356abd9f58
SHA512

6951ca72b75ef7e488311ec4c2f710ea8e87d718b577046b4e1f5a33905da40105024708e48baecf6b33a717b73930411e543fa7237c880c4411679a02e12bde
SSDEEP

1536:uW8KVX8GbWCOyKq7ydruFtZWu+vy6inEmvIv2fHl+kUu59Rz7Ve3l:uWVXvDdfPUu59Rz7Ve3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\audio\AudioPlayer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\audio\AudioPlayer.dll,#1
  2⤵
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads