7c5049b97fb6065b0797da5eca6c94578478cd87e4ae176c68a8bf17f6b03d4a | Triage

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/01/2025, 00:04 UTC

Sharing

Report Analysis Logs

General

Target

dll/libvorbis_64.dll
Size

1.6MB
MD5

074f9a4dbec088d01d4adf8ef03541d5
SHA1

d904f2dde2761cffb0a8b986d53ef3ea410a4418
SHA256

405e3570026a37aab41f26c21ea862c9e554d34b15303f72ada57e7bfbdf44e5
SHA512

ae2d07a83f25fe5c0bf2b9005467c1a37cabbf959a7d11ac2d462f4ec7122897381b1c5ea12e0b459d399a8f0af05d0270e6df26195a64a47ae8ad80c5d8cd58
SSDEEP

6144:6bbUbUwlPxtVNA0ueMSMMYGUXoz0A1VoqxRCv35:0ulPcDe2XNS2J

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2644	2400	rundll32.exe	30
PID 2400 wrote to memory of 2644	2400	rundll32.exe	30
PID 2400 wrote to memory of 2644	2400	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\libvorbis_64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2400 -s 80
  2⤵
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads