66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2

Analysis

max time kernel
1801s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Target

media_dll/avfilter-3.dll
Size

640KB
MD5

d24222e609059f4e9b8205c03c346868
SHA1

2ebf792e612e6e01211fd4df2fc0abfbc015b610
SHA256

553861e15190ace332e5312ae5f2a6d92b0548f106c159f22947b16e0199b3eb
SHA512

935f2c5c4407e4915417704199ec9d0ea47a4557ccdcd60f4c76fb4a963caecd7ed058f425afbc5f1c755105935911b15b11fd70b434a10ae9089807efb8d081
SSDEEP

12288:U0DQE5WhnV2DXojE7+cvG6B4Q2OMfSTGavlvcd2LsLEn:U0DQE5WJjE7+UG6iQyMGavlhLsgn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 4032	3504	rundll32.exe	96
PID 3504 wrote to memory of 4032	3504	rundll32.exe	96
PID 3504 wrote to memory of 4032	3504	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\avfilter-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\avfilter-3.dll,#1
  2⤵
  PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4632

memory/4032-0-0x0000000002100000-0x00000000033D7000-memory.dmp

Filesize
18.8MB

Download
memory/4032-3-0x0000000002100000-0x00000000033D7000-memory.dmp

Filesize
18.8MB

Download
memory/4032-4-0x0000000069900000-0x0000000069BEB000-memory.dmp

Filesize
2.9MB

Download
memory/4032-7-0x00000000624C0000-0x000000006256A000-memory.dmp

Filesize
680KB

Download
memory/4032-6-0x00000000624C0000-0x000000006256A000-memory.dmp

Filesize
680KB

Download
memory/4032-5-0x00000000624C0000-0x000000006256A000-memory.dmp

Filesize
680KB

Download
memory/4032-8-0x0000000069900000-0x0000000069BEB000-memory.dmp

Filesize
2.9MB

Download
memory/4032-9-0x0000000002100000-0x00000000033D7000-memory.dmp

Filesize
18.8MB

Download