6c1468d28ac3c0ada79124e3a76315dc063baa891793ca145621fc54f243448c

Analysis

max time kernel
90s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:48

Target

ZealotAllideoConverter/All Video Converter/libmcl-4.3.0.dll
Size

806KB
MD5

b2971574c8fd84e348bd8c25e4d8e9ed
SHA1

e3962294831d288e04dfa5e3af90ad0b084bc54f
SHA256

89c7c4c79a2686dfa13748f9387242d7110317939e2ac1b0fef3c4f0e7bcc50b
SHA512

963703f87981a1f4bb6064bef6006a26892f4be0facf6812bb553a27bbe551be2a2afe3d7f01d204eede5fc1bdab84dc8fe91cc8ca6076f0815c65cc743c510a
SSDEEP

12288:6GzyrGEYnsvmeyq1ub1v3Yv2lb6NJl4OLHqK:Rur1jgT53YvAbWJmOLH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2520	2304	rundll32.exe	80
PID 2304 wrote to memory of 2520	2304	rundll32.exe	80
PID 2304 wrote to memory of 2520	2304	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libmcl-4.3.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libmcl-4.3.0.dll",#1
  2⤵
  PID:2520