9742689a50e96ddc04d80ceff046b28da2beefd617be18166f8c5e715ec60c59 | Triage

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 06:13

Sharing

Report Analysis Logs

General

Target

libvlc.dll
Size

189KB
MD5

264a9e0194dbd3c0540d67b156ecaaba
SHA1

4f1e7609e3ad169550e082fa35d08a7457a528a0
SHA256

095d164633af53ac015dcd76540e8523744f57d506db111f19b3fdd9d6180833
SHA512

2d1e8a98b8183b76f1b7fe4c8aedae69f903f29cb0e578f82399c5a1e817f479c5e45904f6f1e736b300a9e6d9d33c2caa4b60cb87b0cde3f03321f881c4945c
SSDEEP

3072:MM6pRaubfTPeuD6spsr8VERyc8LQWJLyLMBs1sI:MMAHTTGWI0cyczgLyLR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2896	2872	rundll32.exe	30
PID 2872 wrote to memory of 2896	2872	rundll32.exe	30
PID 2872 wrote to memory of 2896	2872	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 120
  2⤵
  PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-0-0x000007FEF7C20000-0x000007FEF7C54000-memory.dmp

Filesize
208KB

Download
memory/2872-1-0x000007FEF65D0000-0x000007FEF6886000-memory.dmp

Filesize
2.7MB

Download