db063e1db8848a6186721331ae76e07f1615856345dec12b08a2b215ac5bb29b

Analysis

max time kernel
159s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 01:09

Target

plugins/video_output/libdrawable_plugin.dll
Size

30KB
MD5

defb6d6c7bfbddafd3d48d47a69d47a8
SHA1

787c35fa991694f54834d007c13646a219ba43e4
SHA256

aa8cdd685be3ffecb848dd4264061536d562b784c473c3ad1abc1fc3527ac1f5
SHA512

2284fdaec89b819b695db72c493f59b11d60eeab24450c500b0972ee097eae0e51578c0a3044ed100c8ea29e389e46183400ab17140407eebb86a418e04b005f
SSDEEP

384:8SvFL5cokCvUip8Jp8kryYR5dhXveLvDGjoe0ghhH4vDGjoe0ghb:8G7bUHk4p5oDGFhUDGFhb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1912	4724	rundll32.exe	61
PID 4724 wrote to memory of 1912	4724	rundll32.exe	61
PID 4724 wrote to memory of 1912	4724	rundll32.exe	61

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\video_output\libdrawable_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\video_output\libdrawable_plugin.dll,#1
  2⤵
  PID:1912