7ee8f22c98aa12fd857957b213a700b35b3b57522e17d0b584455d08d7cdca4c | Triage

Analysis

max time kernel
361s
max time network
449s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/09/2022, 10:17

Sharing

Report Analysis Logs

General

Target

Lumion 12 Pro/ock/ffmpegsumo.dll
Size

991KB
MD5

83d7e2b05e7fab09258f6763154ce1a2
SHA1

bd80808b0a5b1e32cad270506ca89653a081f3a7
SHA256

f0c4ff613908c0a7b6d3c893984bbd8d63ae21de32d01b45a706667aacff43c6
SHA512

e15524a791118310745645f15c23cd6f8d004c946eb1d3aaea6ab4c4a1300762dad354d374b3bcd029fd30e9fcc54743ae8b4ccb76c7a26b92905de808c83302
SSDEEP

24576:Ms58Z15Ngksc9s0a8wTMMwhmSAzL7aGZELDKPPTykTCO76:MQ2Zgksc9s0aBTMWCO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	1724	WerFault.exe	5

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 904	1724	rundll32.exe	26
PID 1724 wrote to memory of 904	1724	rundll32.exe	26
PID 1724 wrote to memory of 904	1724	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lumion 12 Pro\ock\ffmpegsumo.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1724 -s 92
  2⤵
  - Program crash
  PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads