77c6385d064b1053db2f29e83e6ea83a2c33098b34ae6c4508bf969a97ed7008

Analysis

max time kernel
125s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 03:50

Target
ffmpeg.dll
Size 2.5MB
Sample240519-eeb2wshb98
SHA256 81cab2e7ff56c8a06421419a2dac9481b87d5e50ef6f89a40e9de2d28d4998f2
MD5 54f1cb94776e46864f987eaf0593fbb6
SHA1 f3a9957e79ef290b31e600726b0eef771858b1bd
SHA512 f5aacf89877ac29f4da3263cc7b37b5f25a3425762f96bad90a8389dc596ccef470292f548a1dfce891abd47f4df10d6f2a95fa2f1a4d3a59c2da2ed972c91cc
SSDEEP 49152:DHX9HL2Iv1LDjOzm8H92kpGaWJlAtksQcUfn:TX9HLjdL/OzboAHWb6kDfn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 464	2340	rundll32.exe	89
PID 2340 wrote to memory of 464	2340	rundll32.exe	89
PID 2340 wrote to memory of 464	2340	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
  2⤵
  PID:464