8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23-09-2023 11:05

Target

misc/libvod_rtsp_plugin.dll
Size

112KB
MD5

86b10bda284723b7f993ba0476b7f086
SHA1

e54bff8704640756418655307006bf537c7d1635
SHA256

2d1ffcbaaa604c1aafe8d0ac7c8fa96b429cb0af4ec1caf7bda6df2b50496b2c
SHA512

4b4adc81b50c8267b8419da20253e4e5e4b00798e3215ef451dce95681a7d2d4b1cbc68ffb081269cfb115822a33a249bcd2abddd753afd11f948f7cc2ed4358
SSDEEP

1536:f6yXWnEoNK6bkP0SbQ6b1VUJLq5yj/tvD6LeaZsqYe3JtQECYofyRU:yEoNK2YbbQk1ViLq5kvD6xVgEofKU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1764	2560	rundll32.exe	28
PID 2560 wrote to memory of 1764	2560	rundll32.exe	28
PID 2560 wrote to memory of 1764	2560	rundll32.exe	28
PID 2560 wrote to memory of 1764	2560	rundll32.exe	28
PID 2560 wrote to memory of 1764	2560	rundll32.exe	28
PID 2560 wrote to memory of 1764	2560	rundll32.exe	28
PID 2560 wrote to memory of 1764	2560	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\libvod_rtsp_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\libvod_rtsp_plugin.dll,#1
  2⤵
  PID:1764