50218cd76716ccb1250f1a491cf26c883fdd18cd78b68c385649d3bbcf8c5cb9 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 03:31

Sharing

Report Analysis Logs

General

Target

lib/libsharpyuv.dll
Size

25KB
MD5

2e1c76a2c66847f98db3041a831823e2
SHA1

f2861d5169d4e2fb85467f533be0d511d341e082
SHA256

fe9015622be91d1410683e018496b456003a1745432a879ac8a794f1796d2442
SHA512

42097d384e6c42b2178c85c60867faa9a9375e91de6d170e9e295bd89ac34a7a7755e872b075f140d4e7ed65dde84775be1dab220346a3db305f6854786ba6b0
SSDEEP

384:rbkIELC1utJ324VG6aCpHIYybE24Pb1E:8IELCQJ3FVG6aCSbE2yq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2628	2132	rundll32.exe	30
PID 2132 wrote to memory of 2628	2132	rundll32.exe	30
PID 2132 wrote to memory of 2628	2132	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\libsharpyuv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2132 -s 80
  2⤵
  PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads