77c6385d064b1053db2f29e83e6ea83a2c33098b34ae6c4508bf969a97ed7008 | Triage

Analysis

max time kernel
125s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 03:50

Sharing

Report Analysis Logs

General

Target

ffmpeg.dll
Size

2.5MB
MD5

54f1cb94776e46864f987eaf0593fbb6
SHA1

f3a9957e79ef290b31e600726b0eef771858b1bd
SHA256

81cab2e7ff56c8a06421419a2dac9481b87d5e50ef6f89a40e9de2d28d4998f2
SHA512

f5aacf89877ac29f4da3263cc7b37b5f25a3425762f96bad90a8389dc596ccef470292f548a1dfce891abd47f4df10d6f2a95fa2f1a4d3a59c2da2ed972c91cc
SSDEEP

49152:DHX9HL2Iv1LDjOzm8H92kpGaWJlAtksQcUfn:TX9HLjdL/OzboAHWb6kDfn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2340 wrote to memory of 464	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 464	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 464	2340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
2⤵
PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...