66745a4257b713585ce8e7b16edd8ae00d247f713ad6ea02dc4c39ef94b8c677 | Triage

Resubmissions

28-05-2024 10:29

240528-mjl2nafe8z 7

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 10:29

Sharing

Report Analysis Logs

General

Target

ffmpeg.dll
Size

2.5MB
MD5

4d153867f33b8b517b7a3f8ab6ef6fa5
SHA1

9727614febffbefd66ad70d63a2ad43552d41135
SHA256

76b92fd8be8a585234c446e8bf696758181e3617200d3eca449e1ba3fa150d3a
SHA512

5b4c37479a7dabe6bd85f8050fe2dc36cd9492c419aa5e4225b015befc33bb47fd53ad7fcd91a494f52f55fad90baeef2fc4c7815abd5d50da881ffc8515a127
SSDEEP

49152:XLmyB/kMqMdqev+YEdOzvKi5rWniVA8IOg:7mI/kMqMdqe9zvKiOL8T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 1340	3636	rundll32.exe	84
PID 3636 wrote to memory of 1340	3636	rundll32.exe	84
PID 3636 wrote to memory of 1340	3636	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
  2⤵
  PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads