8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e

Analysis

max time kernel
143s
max time network
280s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16-04-2024 19:36

Target

WidevineCdm/_platform_specific/win_x86/widevinecdm.dll
Size

201KB
MD5

a5d2e984190d21beaa21a34e8f15da4a
SHA1

845bd2253553ef6296b62582566eaed1e1e72a8b
SHA256

56e9a542cd4fb7ddbe03ff3fab718b5f03a3e01447d0463ba0b8d28080a0ffea
SHA512

8577aa85424ba089936c892d477e938bec2ec8ee50ebb06291dd7ddda4b4fb97918415136c27bb01f0084ecbcd24d487269d7a9ef6f6bb5112446694eda90c0b
SSDEEP

6144:8W0GyR4o8ENm2eK7mnoUSgpAY8ODcDcm7cIsNSTa43E7lKtwAO1KQprS2:8WS4XfyE5brKarZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3764	2796	rundll32.exe	79
PID 2796 wrote to memory of 3764	2796	rundll32.exe	79
PID 2796 wrote to memory of 3764	2796	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1
  2⤵
  PID:3764