ab4a56c15a295dda8f74a63cd34c4c7d7e770b5687fe6a346ea081f12dd7aeff | Triage

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 00:41

Sharing

Report Analysis Logs

General

Target

avformat-60.dll
Size

2.4MB
MD5

882eefb6c40827376d2fde359a60e508
SHA1

3a519513ec1c5c5f2583fbc656829e40cfe7a7e8
SHA256

71a23b26f02c0feedc631a0637e8986ccdff84205069932399cdddfe1e4adc24
SHA512

b848c467d8053f18e2798b59222af8bedbe717986624bef0038b8d9425fcf46da70a920c640857600798a6f6ecb47b8cffec2484cc07f5bfe2873cba0d9a14ac
SSDEEP

49152:dDBYBDE5tkWtgMuciN7BIEb6hVk/aWRl4KtfCQ8JDY2za:KAKf7YoaWL4KtfKXa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1884	2004	rundll32.exe	30
PID 2004 wrote to memory of 1884	2004	rundll32.exe	30
PID 2004 wrote to memory of 1884	2004	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avformat-60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2004 -s 136
  2⤵
  PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads