9953bbe13394bc6cd88fd0d13ceff771553e3a63ff84dc20960b67b4b9c9e48e | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 08:35

Sharing

Report Analysis Logs

General

Target

VFS/ProgramFilesX64/AIMP/AIMP.Shared.dll
Size

4.3MB
MD5

cc616bf07d94ae481debdd28de1f16fe
SHA1

274804593a0d060bee8744b2f890dce68b33cbde
SHA256

41a9fa1f175a3368d6cce5f4b0d490d6490c927db78f7bb10bad777ae1881b84
SHA512

f0b3ba41026012a6a4a54209abdbfb6aee1185cdb5336c16702d6d91c958ce8232932b3c8c22f095e6f3b2a32e6cf9fc7f8eabee7a89af2c256cb5503a92369b
SSDEEP

49152:+Rlj9iK3cKMvrcK5hZKizUHyheVtVjBd6Slgx2w3y:+n9Z7tVjBd6Sla2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3040	1728	rundll32.exe	31
PID 1728 wrote to memory of 3040	1728	rundll32.exe	31
PID 1728 wrote to memory of 3040	1728	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\AIMP\AIMP.Shared.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1728 -s 244
  2⤵
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000001D30000-0x0000000001D51000-memory.dmp

Filesize
132KB

Download
memory/1728-1-0x000007FEF7390000-0x000007FEF73EA000-memory.dmp

Filesize
360KB

Download
memory/1728-4-0x0000000074E50000-0x0000000075299000-memory.dmp

Filesize
4.3MB

Download
memory/1728-5-0x0000000073550000-0x0000000074240000-memory.dmp

Filesize
12.9MB

Download