Analysis
- max time kernel
143s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
05/06/2024, 04:08
General
- Target Data/avdevice-58.dll
- Size 1.2MB
- Sample240605-eql18sdg3z
- SHA256 8c7497c4670fad30b2ca4607d7168f47b1cbc8ba55a3de77051b1bc8e5680ffe
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avdevice-58.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avdevice-58.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 9643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2188 -ip 21881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2188-0-0x0000000074E00000-0x0000000074F3B000-memory.dmp
memory/2188-1-0x0000000074490000-0x0000000074DA5000-memory.dmp
memory/2188-2-0x00000000737B0000-0x0000000073AC4000-memory.dmp
memory/2188-3-0x0000000073AD0000-0x000000007448B000-memory.dmp
memory/2188-5-0x0000000073650000-0x00000000736E2000-memory.dmp
memory/2188-4-0x00000000736F0000-0x0000000073774000-memory.dmp
memory/2188-6-0x0000000070DC0000-0x0000000073649000-memory.dmp