ed5fe5eb0d0146db50d8848052a4a9177c50ea00c51471f4489f1327370133d4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 09:33

Target

Total Video Converter/dvdapi.dll
Size

300KB
MD5

8a8b9b3b737437ca407cf61c2cfdd980
SHA1

4c82cc14df6e3f68a31fcee2351bda91fe5464b5
SHA256

15c8b2b53e24831288e74e81a5e46537e698885bddd26dc179f88b43b19d068b
SHA512

c7539ada5edf2a604763e73c01c54dda6f319932d6752e9d5ea4842886b8772c33cb520fe008281e5ed8a6749ea2202f07a865a410b4dae3b81031a591c9e815
SSDEEP

3072:+2TJeasTWKW4KZPstl4pQi6qU+fqfGNN975AT6fPm5F+iVfPhpBk6o13FJS6twaj:XggPR5AT6fPwhhpBORtwa3FMISVDY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1880	2556	rundll32.exe	16
PID 2556 wrote to memory of 1880	2556	rundll32.exe	16
PID 2556 wrote to memory of 1880	2556	rundll32.exe	16
PID 2556 wrote to memory of 1880	2556	rundll32.exe	16
PID 2556 wrote to memory of 1880	2556	rundll32.exe	16
PID 2556 wrote to memory of 1880	2556	rundll32.exe	16
PID 2556 wrote to memory of 1880	2556	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\dvdapi.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\dvdapi.dll",#1
  2⤵
  PID:1880