f506ec5cb0402dd85556c5cfd38d6b5de72e8bd242aa7a2143ab1063c19f0bc2 | Triage

Analysis

max time kernel
133s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

XAudioEngine.dll
Size

388KB
MD5

6d4787a1ff33fbff8d3f172b97b7b476
SHA1

408d908f11348b76fa613a3a5a3053521e81407d
SHA256

77acb7f1baef9e00f29994d49d179062ccc177dac12f56d5680f9d1aa0f6db3c
SHA512

26567cfd8c51c1d382c62eada4285e733a988f97879a61de89b3bd84e6b3fae9c2b66c7417a0295cab665c8b2ce6145b3d0010d672897db8500c84db89d3679a
SSDEEP

6144:poU3HSZ1/s36CyXfTnJqNPnsPE7J1hcBxCF0UtGr:poU3SZ5s36CyXfNqNPns87J1aD9Ut

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 3992	3092	rundll32.exe	84
PID 3092 wrote to memory of 3992	3092	rundll32.exe	84
PID 3092 wrote to memory of 3992	3092	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XAudioEngine.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XAudioEngine.dll,#1
  2⤵
  PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads