91ff99594f87c113f6087359093099cdbbc1fc19b1a03bee9b52ed86a47c2835 | Triage

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 11:20

Sharing

Report Analysis Logs

General

Target

Voxformer x64.dll
Size

17.9MB
MD5

aff97189d9460d0019f52fbd574afb65
SHA1

5ad0878ddcffeb79e5c4ce835f2515d5e3da3ed5
SHA256

f413737fbd10e378385b0159deec14637d617d7ebbd4484c3bd68453f7b8d7a1
SHA512

18e98d42d8e5cf654cf0bded2b35aac02cd187273e9d6a19470c8d9ae35b402e1e70ceaa3f48be64e7f27116b75e3c479937aa6ef803648dbed839a8facffc47
SSDEEP

196608:KzviydGaA1ihl6KVjUKeAzKaNN/La5sRMCF:1S6KBzvNm5x4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2404	1656	rundll32.exe	29
PID 1656 wrote to memory of 2404	1656	rundll32.exe	29
PID 1656 wrote to memory of 2404	1656	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Voxformer x64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1656 -s 188
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads