9645096bc9e53a83a9aaa69a13c82fea38c8719faf27298afd25892bd9f788ec | Triage

Resubmissions

24/02/2025, 12:08

250224-pa55aa1pw5 10

24/02/2025, 09:40

250224-lnmnbavpt3 10

20/02/2025, 03:42

250220-d9d93awkdk 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/02/2025, 12:08

Sharing

Report Analysis Logs

General

Target

libvlccore.dll
Size

2.7MB
MD5

c62c3ef5753af6e0980f38eebc196b1c
SHA1

fd1d62feaaacb7cad5f952b61a6f7bd60d6dc4e1
SHA256

2ddb85b36650f85b5a09724c5b17428b1b1b76bd3e3dd85b643933659d5e333d
SHA512

f2338d26b073d8a796a7a19ee290b87b63f30f6cfa62e74d147756d2362898a167784c860d9bc098b1ec1a080aaa0fad25ca8c611b7e8f42ea8195c2b14abdfc
SSDEEP

49152:0F0rn/mnSnjfazU2TGlMo1PBAUZLY6sEZGaXBuQQ9eI:0F07L60PBAUZL3W

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2836	2860	rundll32.exe	30
PID 2860 wrote to memory of 2836	2860	rundll32.exe	30
PID 2860 wrote to memory of 2836	2860	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlccore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2860 -s 120
  2⤵
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x000007FEF5740000-0x000007FEF59F6000-memory.dmp

Filesize
2.7MB

Download