941cc44f629086310dba8c9e96ab55994f230eef6917a2e70ec6c9b698154d88 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 12:13

Sharing

Report Analysis Logs

General

Target

Codec/rtvcvfw32.dll
Size

871KB
MD5

0a91221306a3298fba8fd1e0d4be269a
SHA1

2ecc9696f03fa694aa0ff01e3658bb24e632ed91
SHA256

7865c3e4003778ced6aa3ebcb7fad83421a45a13eb43ea2a5ba303d8e479a4b7
SHA512

01885ebb32e0b4ed703341bc083f721393ab2ac1663ac3aaefcdd31990bca4a103e88afb631041bf1a565cb328fefbe8d60e1463f19f9d33f0b0b1affda64045
SSDEEP

24576:huBpXNDkxDRsX1sUsJ7mq/ZBx69v9IbzehK9Ko:hqBNgJ7D29Ibzec

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2968	2972	rundll32.exe	28
PID 2972 wrote to memory of 2968	2972	rundll32.exe	28
PID 2972 wrote to memory of 2968	2972	rundll32.exe	28
PID 2972 wrote to memory of 2968	2972	rundll32.exe	28
PID 2972 wrote to memory of 2968	2972	rundll32.exe	28
PID 2972 wrote to memory of 2968	2972	rundll32.exe	28
PID 2972 wrote to memory of 2968	2972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Codec\rtvcvfw32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Codec\rtvcvfw32.dll,#1
  2⤵
  PID:2968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads