fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
148s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:08

Target
Data/avfilter-7.dll
Size 9.0MB
Sample240605-eql18sdg3z
SHA256 1b0abbbb895fa1564fc09ce55ea1d5d9af784ddb131cc36e3bdba79ee13c7dbf
MD5 2a2eece3adedce286afe80cf44bad28a
SHA1 a82579e5a74d75970e49d5e978079da1a236ded6
SHA512 f528461cc7319eab2f8d6b8e0e1529c08ded50f06c978301ef751f4848f4b0350b75dadb359ea36725e3b5ffbba68a6367aa8f4e9fc1e6724d33850b489d39c6
SSDEEP 196608:PdzE9yvEkTOPvkos1Uc4jD3trgMBhukmFBYYGiFK7xPucQOTUfu8lmSqir54qu7h:PJ3s7xmcQOTUG8lme5y7hvuA6oO07rok
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3676	4980	rundll32.exe	85
PID 4980 wrote to memory of 3676	4980	rundll32.exe	85
PID 4980 wrote to memory of 3676	4980	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avfilter-7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avfilter-7.dll,#1
  2⤵
  PID:3676