b11fa6b0699d9f9c43be01194e6383348ee504f78863454d26e048fe61397518 | Triage

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 13:06

Sharing

Report Analysis Logs

General

Target

MediaPlayer.dll
Size

549KB
MD5

acc2e7980870a844122dae290bb96e75
SHA1

49705dfc34c32005e11bbc96471c6d841586fcb1
SHA256

945f9a34c5efbc6e3711d6bf2b3cfd14b1ee89d70a6fa447c642696ff4a8dde9
SHA512

5f1245a7ce5de48414709cadb13f20e928a330f37f709ad893c0501cc64b87bdeb14978d824e37a3908a15cedf7c71e4fe5e47ff69ede7d353a723e0108dc05f
SSDEEP

12288:SrAVZQZXxuC0Cc4toFf6zHFZYrE8mpB4J9rBddRW+n4pg1Rca:Sr6cxgCc4SFi5ZHW5Bddw+n4/a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
220	4060	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 4060	2052	rundll32.exe	85
PID 2052 wrote to memory of 4060	2052	rundll32.exe	85
PID 2052 wrote to memory of 4060	2052	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaPlayer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaPlayer.dll,#1
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 684
    3⤵
    - Program crash
    PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4060 -ip 4060
1⤵
PID:208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4060-0-0x00000000020A0000-0x00000000022BD000-memory.dmp

Filesize
2.1MB

Download
memory/4060-1-0x00000000020A0000-0x00000000022BD000-memory.dmp

Filesize
2.1MB

Download
memory/4060-2-0x00000000020A0000-0x00000000022BD000-memory.dmp

Filesize
2.1MB

Download
memory/4060-5-0x00000000020A0000-0x00000000022BD000-memory.dmp

Filesize
2.1MB

Download