9742689a50e96ddc04d80ceff046b28da2beefd617be18166f8c5e715ec60c59 | Triage

Analysis

max time kernel
145s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 06:13

Sharing

Report Analysis Logs

General

Target

libvlccore.dll
Size

2.7MB
MD5

c62c3ef5753af6e0980f38eebc196b1c
SHA1

fd1d62feaaacb7cad5f952b61a6f7bd60d6dc4e1
SHA256

2ddb85b36650f85b5a09724c5b17428b1b1b76bd3e3dd85b643933659d5e333d
SHA512

f2338d26b073d8a796a7a19ee290b87b63f30f6cfa62e74d147756d2362898a167784c860d9bc098b1ec1a080aaa0fad25ca8c611b7e8f42ea8195c2b14abdfc
SSDEEP

49152:0F0rn/mnSnjfazU2TGlMo1PBAUZLY6sEZGaXBuQQ9eI:0F07L60PBAUZL3W

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1792	2796	rundll32.exe	29
PID 2796 wrote to memory of 1792	2796	rundll32.exe	29
PID 2796 wrote to memory of 1792	2796	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlccore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2796 -s 124
  2⤵
  PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-0-0x000007FEF6120000-0x000007FEF63D6000-memory.dmp

Filesize
2.7MB

Download