35c83063d6236e46106b3fb0c9e1e2c8d1373336c11a6eb7cad3399c8324cca4 | Triage

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 15:50

Sharing

Report Analysis Logs

General

Target

avutil-58.dll
Size

948KB
MD5

ce08a4d6f95afb71937a3f303bf782f3
SHA1

96f11c41f6fef3dd9ec57400892aa3cd9a764c3f
SHA256

720c5e2e6d63f1fcaacefb307295abb4f7ea1b4ca3a34303c1d37bb43e3889f5
SHA512

c82331d51eb50ac397858070330dc722bd6902990adc79636fd908d6f2b055bbd6b120c2585df87a6f8e805c8c66378b240a11a66799ca6d38715b5a6a0b455a
SSDEEP

12288:nf3jeNxwYyACmqLzN8VTyCLrq9kBYgYkQRMe+ugMSr/:nreNxjwmqLzN8V+C/rYcrR/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2964	2212	rundll32.exe	28
PID 2212 wrote to memory of 2964	2212	rundll32.exe	28
PID 2212 wrote to memory of 2964	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avutil-58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2212 -s 96
  2⤵
  PID:2964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-1-0x000007FEFBD80000-0x000007FEFBD97000-memory.dmp

Filesize
92KB

Download
memory/2212-0-0x000007FEF6080000-0x000007FEF6287000-memory.dmp

Filesize
2.0MB

Download