1ac32cdb8b9969bdb69f97fbfc8f65aaa6bd0f65ee068ff99e6a4e4b073c51fd | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 06:50

Sharing

Report Analysis Logs

General

Target

$PROGRAMFILES/QvodPlayer/Codecs/drvc.dll
Size

28KB
MD5

1197b01e99216f51be418c0ebc758522
SHA1

3d6b5167a747b6c1f54575f2047fdef6f293f1d1
SHA256

004e45d3d3d721f0295a9f430ce3d46ebe7b9a5df797b0ea9029c74509c34600
SHA512

6e172b8cb66a326d16d8eb9c4e3e0bc0df773ca887a15643ac328ddefa3ad5a982f514dae5b5b4439808afe823414b94f2a26732b9f3e8ad9cbd245cf7e6ee6c
SSDEEP

768:D/HWfTds7D+aqQZANSBLKwY8LBIonnMFvX8I:SfTdSsNngAvX8I

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2332	2644	rundll32.exe	30
PID 2644 wrote to memory of 2332	2644	rundll32.exe	30
PID 2644 wrote to memory of 2332	2644	rundll32.exe	30
PID 2644 wrote to memory of 2332	2644	rundll32.exe	30
PID 2644 wrote to memory of 2332	2644	rundll32.exe	30
PID 2644 wrote to memory of 2332	2644	rundll32.exe	30
PID 2644 wrote to memory of 2332	2644	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\QvodPlayer\Codecs\drvc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\QvodPlayer\Codecs\drvc.dll,#1
  2⤵
  PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads