4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 11:50

Target
avdevice-58.dll
Size 742KB
Sample240329-nzkdfagg89
SHA256 28ab8d61b11fd59d4140bbf840c2c6d122849c659fbfd55a94591ffac93e1820
MD5 249609ca649419f2bff0bd551f8f4307
SHA1 7a10c99216ef7ad0a726cb5d987fb94a5fd68cd9
SHA512 5ca215f007803c7b76fb1c59ba605be7b178349451ba1e85cf04189b69f82b70ae9ea6a3d904a574fe6c89228fc3ec4a4c411b77f578ee9a3e56f4f7481e002b
SSDEEP 12288:Ot+jc50Dcgc0uqCfktrocWGueTp8HWqdIKDGMB8HPPf1Hvkg:OscRKMUvph
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avdevice-58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 124
  2⤵
  PID:2052