48a2db38aba347d0f611cac788d63cc612bbb5cee9b2109a18525e84923040db | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 13:46

Sharing

Report Analysis Logs

General

Target

MediaEngine.dll
Size

729KB
MD5

ff7f92c7a42a865143a639c10e1cc6d6
SHA1

799f9fcef95c14449b0a92a37469a714b289f9d4
SHA256

c98357516d7758fc2b2cd12e65bbbac151061d25904fdbdc56d1279774a7797e
SHA512

4f50ef29fab8e51b3eb5484c45c0603d75729e496a53a4e9a22e3d03fdd6480c5e96211b7e5b7b0884ef60ee5bde613fe36e9ad5167aca4212eb94fd56cabcb4
SSDEEP

12288:KvnO87oehO/eXzd8ahqjtT1f6ge8M7KuLucnAWwWoEXr48xrt6mm7Uco:KGS2eR8ltpQhoEXr4wt98o

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2264	3044	rundll32.exe	30
PID 3044 wrote to memory of 2264	3044	rundll32.exe	30
PID 3044 wrote to memory of 2264	3044	rundll32.exe	30
PID 3044 wrote to memory of 2264	3044	rundll32.exe	30
PID 3044 wrote to memory of 2264	3044	rundll32.exe	30
PID 3044 wrote to memory of 2264	3044	rundll32.exe	30
PID 3044 wrote to memory of 2264	3044	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1
  2⤵
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads