e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864 | Triage

Resubmissions

28-03-2024 09:19

240328-laa3cshc5s 10

28-03-2024 09:13

240328-k6zvxseh67 10

Analysis

max time kernel
9s
max time network
20s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 09:19

Sharing

Report Analysis Logs

General

Target

ffmpeg.dll
Size

2.4MB
MD5

2132fad8315a47284cb3ffc75b318b28
SHA1

1f41e3b2dbb2dd2f59f3a278bdae715c15a5948a
SHA256

5923c9159b33f5645741afef4550a7c3a57283cb6c22b95b677c8d4799d3db29
SHA512

f5eeabda49d1938a24a5c8859ca2707368ce874bcee57c658d8b1013572b92687de92159df6b3db0f19e46ae9809873103beba50233b2925ef6ae76855011945
SSDEEP

49152:6KYNFzdKB6gk9BZy67nmzmu7V78UOylBW:6BrzrLbmzm5yn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1772	2508	rundll32.exe	28
PID 2508 wrote to memory of 1772	2508	rundll32.exe	28
PID 2508 wrote to memory of 1772	2508	rundll32.exe	28
PID 2508 wrote to memory of 1772	2508	rundll32.exe	28
PID 2508 wrote to memory of 1772	2508	rundll32.exe	28
PID 2508 wrote to memory of 1772	2508	rundll32.exe	28
PID 2508 wrote to memory of 1772	2508	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
  2⤵
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads