66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2

Analysis

max time kernel
1737s
max time network
1170s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Target

media_dll/avdevice-54.dll
Size

118KB
MD5

cc7e391e60fce815f5bc2723d9c54d70
SHA1

ad1850e57fd3e8f751bf800faddd5bd98b465115
SHA256

ee64ca09649863e70f6d7dac266e866e01060278fc8914339b154d1d15bc81d0
SHA512

abfbc591e4f2c902ab00d89f6d8cf1ef5d905679154141e363d0a3787aca859783e0ec72450a3f901653bb14650e7160b74801d243af977a9d666c9d2509b038
SSDEEP

1536:N5aTJlMvf9TawKEfY0fF2j+3yixDYiTRr2TUMDWedkD5eEbBTjcq7B8OcsL60trh:fEJlMv1TN/g6q+3y+DqHqdTj/7JtC6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 3384	3460	rundll32.exe	88
PID 3460 wrote to memory of 3384	3460	rundll32.exe	88
PID 3460 wrote to memory of 3384	3460	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\avdevice-54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\avdevice-54.dll,#1
  2⤵
  PID:3384

memory/3384-0-0x0000000002630000-0x0000000003907000-memory.dmp

Filesize
18.8MB

Download
memory/3384-4-0x0000000002630000-0x0000000003907000-memory.dmp

Filesize
18.8MB

Download
memory/3384-5-0x0000000069900000-0x0000000069BEB000-memory.dmp

Filesize
2.9MB

Download
memory/3384-6-0x00000000624C0000-0x000000006256A000-memory.dmp

Filesize
680KB

Download