aa3096afab2baec1de03c610cd3133bab3abeeb6d1cd11530088f8dfe77c5fc1 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 20:21

Sharing

Report Analysis Logs

General

Target

MediaInfo_i386.dll
Size

6.2MB
MD5

92ca7e5d272e75a260ac9c326184e561
SHA1

9640262e59714e6909edfab5b0f59fb6fc374e4d
SHA256

bb2451d45677197c42655b51fafb95d7be0c2fc3998e4de8bd3a7ee2146de52b
SHA512

eedbb4f66c04c03d2fcc0e8af8648a1986ea77468a5778d6bca6839d9633ea044cba00535c742478684803f8fc6a72366f654be5ac5b45a35798060d84141235
SSDEEP

98304:8DnZ93i5eqrKnv31BWxlSkMPDgc/YYYHDPQ4SqDX:87Z9ieqmtJB/mZD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1232 wrote to memory of 2116	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 2116	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 2116	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 2116	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 2116	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 2116	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 2116	1232	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaInfo_i386.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaInfo_i386.dll,#1
2⤵
PID:2116

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...