6a1bdfae4f1a8518dabad69c758c063e36298151a4f8c9b5ce0d7fedceafaf53 | Triage

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 21:04

Sharing

Report Analysis Logs

General

Target

phonon4.dll
Size

336KB
MD5

a09838bbe26df71531cda43002e39dfc
SHA1

0e5a6ca284909c88369e87dabeb52d341df1c811
SHA256

e72abdc5425d6bcf249f81879b616f7c5b4da737d33a2dc3fb41d5ceeff72c53
SHA512

30e48449b4c61527044606bf2374f47982272d31f6e553f4aadb658a210c3b70e0a15cf53fcf5f99db15c52f7a74a424e81d94e991d7bf0b40ab7b319bbbf49f
SSDEEP

6144:TR8OBIoTZKKsYEzDQD8By4IZvyFFjUPpQY2zhA3BJQa:GOBIPJQD8BwvyFv7a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\phonon4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\phonon4.dll,#1
  2⤵
  PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads