35bcbe83559ef07628aeb933f9c556b3a091ac996fb35508a482e3cd367d6a18

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 13:21

Target
xvidcore.dll
Size 744KB
Sample240228-qlrayace5w
SHA256 83cb7c62f4c43ac8cb6bad480a1745e19e3a6ed85d7d385b4b9f11168f538142
MD5 81cca8c60dd2edaf394b6e75ff8e325f
SHA1 75c8bde8324f2ab3edf7e959cc7bd8a86636112a
SHA512 3f97db5dbb71c21cea08593d6e26350642f6c4ce8c24e11568dabd4db4213e8bfe3b6adf08089cfd928da05e6344b92d83b9f61eec8286c3130944442d53e254
SSDEEP 12288:Qp6K/8uZ0fQYbA/HqSqJztRj1hLGha8DMCdlpdAKSWAKSwapL+mrlVr+Tfu5O7YU:U6K0uZ0fp0/HqSOtRTLGha8DMCdlpfac
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 5080	4600	rundll32.exe	87
PID 4600 wrote to memory of 5080	4600	rundll32.exe	87
PID 4600 wrote to memory of 5080	4600	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xvidcore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xvidcore.dll,#1
  2⤵
  PID:5080