d24d1726864be6bf4458f9c23ab89c03506bbb7d662cb68c27dff4c97e560e91 | Triage

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 07:13

Sharing

Report Analysis Logs

General

Target

bin/DshowPlayer.dll
Size

72KB
MD5

62e23d043ae5281f661dd58c1393d94e
SHA1

048e25c3c3b128e8b5e849f6fe3f4e0cfec38164
SHA256

f44858ab819f99252ed0d8fc377146205d867d5db1c172e5651befde07b58329
SHA512

adc811701dfcda3df79b21197b303339fc8876af4dc0b08af0af851faf31a6ea7423d8ccbec44e7bb422137ea2a83f1f591a4d8c5c88a5ffdbdad84894b0bcc9
SSDEEP

1536:bbs3S8FIH/xwm4BTHEyZarMDTZO1BmZzfTeafCV:bbs3Sxf4RHEy8rMZO1Bm5S

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Log	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\Conf	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\Conf\Default	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1640	2368	rundll32.exe	30
PID 2368 wrote to memory of 1640	2368	rundll32.exe	30
PID 2368 wrote to memory of 1640	2368	rundll32.exe	30
PID 2368 wrote to memory of 1640	2368	rundll32.exe	30
PID 2368 wrote to memory of 1640	2368	rundll32.exe	30
PID 2368 wrote to memory of 1640	2368	rundll32.exe	30
PID 2368 wrote to memory of 1640	2368	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\DshowPlayer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\DshowPlayer.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-0-0x0000000000190000-0x000000000019D000-memory.dmp

Filesize
52KB

Download
memory/1640-1-0x0000000000710000-0x0000000000757000-memory.dmp

Filesize
284KB

Download
memory/1640-3-0x0000000000200000-0x0000000000227000-memory.dmp

Filesize
156KB

Download
memory/1640-5-0x0000000000760000-0x0000000000772000-memory.dmp

Filesize
72KB

Download