df8d5c1e306475f776e460ad64c54e8ecc09326dfd4bb95994528dd08c04ef9f | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 00:06

Sharing

Report Analysis Logs

General

Target

MediaInfo.dll
Size

545KB
MD5

6ec40f6a2ac2ad1b3eb61b0ff6e0a42a
SHA1

d9385b8c6ae8c90b8305aa1da7f62cd8038d8134
SHA256

f8e03c0035c917746d6b8855d595c1732cc49821f5fbdc722dccbb447f58560a
SHA512

4a008dee40d60b310108030f0e3a38b8387b36923ed0c567de7eaa928d0a3c3d4440112110fe7a607d2f531b67cc0d1b4783f12cf3f36b09616a456d47bd7bcd
SSDEEP

12288:MYVj6mhnSjOrBaBd4fRw9grVEDisIL5m/QUDzxkw/Og6zg1I6d/oST:MYE/CU6ZnrVEDisCmISbcx6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/memory/2744-0-0x0000000010000000-0x0000000010215000-memory.dmp	upx
behavioral5/memory/2744-1-0x0000000010000000-0x0000000010215000-memory.dmp	upx
behavioral5/memory/2744-2-0x0000000010000000-0x0000000010215000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2744	2180	rundll32.exe	30
PID 2180 wrote to memory of 2744	2180	rundll32.exe	30
PID 2180 wrote to memory of 2744	2180	rundll32.exe	30
PID 2180 wrote to memory of 2744	2180	rundll32.exe	30
PID 2180 wrote to memory of 2744	2180	rundll32.exe	30
PID 2180 wrote to memory of 2744	2180	rundll32.exe	30
PID 2180 wrote to memory of 2744	2180	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaInfo.dll,#1
  2⤵
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-0-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download
memory/2744-1-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download
memory/2744-2-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download