4d4c6e971e2c8635ffdcc310998c0ab3b72595cc6589754666554da4128c4862 | Triage

Analysis

max time kernel
133s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 09:00

Sharing

Report Analysis Logs

General

Target

Akebi/ffmpeg.dll
Size

1.2MB
MD5

eae2a95bb9404eda67360ebefeb32080
SHA1

a2ba1507a815c54a91f74f3f1965ff1cceb75e13
SHA256

ebdf82bf567ba506879352053d5d670b369a41cfe783f3c177010460146518d3
SHA512

f6a06c3d678195b5c9b091e89b4493cf4012f1cf1f820f2778d28236d9566ed115feacb07f237ec79a8b71ddba3453d57233c63e079a0b498ad09b561a0e472c
SSDEEP

24576:y8M3T0FajLnlBXECsd/BgXJ8dr6VG74+lOjAd/o7Cln:yjb3lZ6d68N0V+lD1o7Cln

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4144 wrote to memory of 3516	4144	rundll32.exe	rundll32.exe
PID 4144 wrote to memory of 3516	4144	rundll32.exe	rundll32.exe
PID 4144 wrote to memory of 3516	4144	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Akebi\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Akebi\ffmpeg.dll,#1
2⤵
PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...