0ee6265fb360ff4f06ac38b3f69689d3e74889a8ed9f92c2cb21a90e9efb2263 | Triage

Resubmissions

29-11-2024 14:08

241129-rfpqlazjg1 10

29-11-2024 14:03

241129-rcyjbsyrd1 10

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 14:08

Sharing

Report Analysis Logs

General

Target

bin/reports/libmpg123-0.dll
Size

343KB
MD5

3f7eaeae23e4314139b52979c9a18702
SHA1

4e64337033f6a7db7d0355c6a2b54c0cbc037e3c
SHA256

24e71004d29377b42a5145acdac4195da073a3a0b8e96d9a37b286fb09b2cba7
SHA512

e0090dc693711ea5fa061b6dcc9bd7f0f81f281b000b3d77ad2c4777a367fa3f7c3d0628668d0f6afabad8fc05c508f5014198de79b6cc4e2b890d2e916516ff
SSDEEP

6144:Mb9EIu7V5XCvMGyyXts3Hilvqj5euBtYJFSv+:Mb9pYXCUGyv3HWv0HIJFSv+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1488	1196	rundll32.exe	30
PID 1196 wrote to memory of 1488	1196	rundll32.exe	30
PID 1196 wrote to memory of 1488	1196	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\reports\libmpg123-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1196 -s 88
  2⤵
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x0000000063C80000-0x0000000063CEA000-memory.dmp

Filesize
424KB

Download