df8d5c1e306475f776e460ad64c54e8ecc09326dfd4bb95994528dd08c04ef9f | Triage

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 00:06

Sharing

Report Analysis Logs

General

Target

MediaInfo.dll
Size

545KB
MD5

6ec40f6a2ac2ad1b3eb61b0ff6e0a42a
SHA1

d9385b8c6ae8c90b8305aa1da7f62cd8038d8134
SHA256

f8e03c0035c917746d6b8855d595c1732cc49821f5fbdc722dccbb447f58560a
SHA512

4a008dee40d60b310108030f0e3a38b8387b36923ed0c567de7eaa928d0a3c3d4440112110fe7a607d2f531b67cc0d1b4783f12cf3f36b09616a456d47bd7bcd
SSDEEP

12288:MYVj6mhnSjOrBaBd4fRw9grVEDisIL5m/QUDzxkw/Og6zg1I6d/oST:MYE/CU6ZnrVEDisCmISbcx6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral6/memory/3228-0-0x0000000010000000-0x0000000010215000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 3228	1504	rundll32.exe	82
PID 1504 wrote to memory of 3228	1504	rundll32.exe	82
PID 1504 wrote to memory of 3228	1504	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaInfo.dll,#1
  2⤵
  PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3228-0-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download