ccc65cc16770cf1f444219f00680f9fe6234d543107e98413bb06c68aea92e86 | Triage

Analysis

max time kernel
114s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 08:09

Sharing

Report Analysis Logs

General

Target

Korepi/ffmpeg.dll
Size

1.2MB
MD5

eae2a95bb9404eda67360ebefeb32080
SHA1

a2ba1507a815c54a91f74f3f1965ff1cceb75e13
SHA256

ebdf82bf567ba506879352053d5d670b369a41cfe783f3c177010460146518d3
SHA512

f6a06c3d678195b5c9b091e89b4493cf4012f1cf1f820f2778d28236d9566ed115feacb07f237ec79a8b71ddba3453d57233c63e079a0b498ad09b561a0e472c
SSDEEP

24576:y8M3T0FajLnlBXECsd/BgXJ8dr6VG74+lOjAd/o7Cln:yjb3lZ6d68N0V+lD1o7Cln

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3432	4164	rundll32.exe	87
PID 4164 wrote to memory of 3432	4164	rundll32.exe	87
PID 4164 wrote to memory of 3432	4164	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\ffmpeg.dll,#1
  2⤵
  PID:3432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads