db063e1db8848a6186721331ae76e07f1615856345dec12b08a2b215ac5bb29b

Analysis

max time kernel
19s
max time network
29s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 01:09

Target

plugins/video_output/libdrawable_plugin.dll
Size

30KB
MD5

defb6d6c7bfbddafd3d48d47a69d47a8
SHA1

787c35fa991694f54834d007c13646a219ba43e4
SHA256

aa8cdd685be3ffecb848dd4264061536d562b784c473c3ad1abc1fc3527ac1f5
SHA512

2284fdaec89b819b695db72c493f59b11d60eeab24450c500b0972ee097eae0e51578c0a3044ed100c8ea29e389e46183400ab17140407eebb86a418e04b005f
SSDEEP

384:8SvFL5cokCvUip8Jp8kryYR5dhXveLvDGjoe0ghhH4vDGjoe0ghb:8G7bUHk4p5oDGFhUDGFhb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2688	2512	rundll32.exe	28
PID 2512 wrote to memory of 2688	2512	rundll32.exe	28
PID 2512 wrote to memory of 2688	2512	rundll32.exe	28
PID 2512 wrote to memory of 2688	2512	rundll32.exe	28
PID 2512 wrote to memory of 2688	2512	rundll32.exe	28
PID 2512 wrote to memory of 2688	2512	rundll32.exe	28
PID 2512 wrote to memory of 2688	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\video_output\libdrawable_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\video_output\libdrawable_plugin.dll,#1
  2⤵
  PID:2688