ac94101c9d78aded5c0ce3207fb99bb4cb7083ec635b6fe7ed26b9414930d7ae | Triage

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 21:58

Sharing

Report Analysis Logs

General

Target

ffmpeg.dll
Size

2.5MB
MD5

c47ca627962e1a67354b9a4fb6c48111
SHA1

cb6dc830966bfe2ddcc338ccb4e4863ce7eee6dc
SHA256

ecf79b4fd73600c7171ff84ce10b547a3354652e93efff2d61f97d32048624be
SHA512

6660f1a81ce59f6b28242a609794db2ce61abf888dd7d0fccfb8af797a8bfc36c71a119d5a1e762b21176e56191b7bdc48067dc428b9c825734d0a35ac6a6ff0
SSDEEP

49152:+LmyB/kMqMdqev+YEdOzvKi5rWniVA8IOZ:WmI/kMqMdqe9zvKiOL8T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4056	2496	rundll32.exe	87
PID 2496 wrote to memory of 4056	2496	rundll32.exe	87
PID 2496 wrote to memory of 4056	2496	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
  2⤵
  PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads