Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    17-08-2024 03:08

General

  • Target

    $SYSDIR/avfilter-lav-2.dll

  • Size

    135KB

  • MD5

    80687813509ba2d2a686b2a401bb4373

  • SHA1

    6b6d3d4540df94f0836830aae8624207f6427c0d

  • SHA256

    7e4b9aca83143c0902f217f7c7b36fddd03868c4d637587247109fc0257f5ec6

  • SHA512

    111321aaefba9f7cfc960f505bbb0f42cd5af6617fd4b34125b2ac34cd8db97b9db1b86de2fe41088f28cd439547eed5e6820b90eb5af796945c45fc0161d2a5

  • SSDEEP

    1536:XfmRcmuw26XVEGmaN717CHlszMVRGti+dGF0Wd7yxqJRcnkEthQtZEGEilnYgMk4:uRcPwGaN717SVii+dEpyx+EBkr2b1P

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\avfilter-lav-2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\avfilter-lav-2.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1160-164-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-182-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-181-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-120-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-72-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-68-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-67-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-64-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-65-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-63-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-62-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-61-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-60-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-58-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-56-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-57-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-55-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-54-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-52-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-51-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-50-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-49-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-48-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-47-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-46-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-45-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-44-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-43-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-39-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-40-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-38-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-37-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-36-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-35-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-34-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-33-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-32-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-31-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-30-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-27-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-25-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-26-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-24-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-23-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-22-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-21-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-20-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-18-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-16-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-15-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-14-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-13-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-12-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-11-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-10-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-8-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-7-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-6-0x0000000071104000-0x0000000071140000-memory.dmp

    Filesize

    240KB

  • memory/1160-5-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-4-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-3-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-2-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-1-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-0-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-150-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-135-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-105-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-88-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-69-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-53-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-41-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-29-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB

  • memory/1160-17-0x0000000071100000-0x0000000071156000-memory.dmp

    Filesize

    344KB