fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
142s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:08

Target
Data/avutil-56.dll
Size 1012KB
Sample240605-eql18sdg3z
SHA256 b5403471304237e2486a1d5934149ea493eac3859d9d423d5630226dfb10fb44
MD5 6d4099c60bf587da444fb3c8d639c6a1
SHA1 5522a4d16342ac33c30a8f3b753eb174cae30bfe
SHA512 37122057cc98e55e88337b54735aa217361b12cefc899340a46626792403b34ab71af763e0d395c793e93f76479f7b1c36d6479a7579ab04c45ed98f50b65fbc
SSDEEP 12288:hILFD9BRz6CxSLPSmi3D1qzq1x3pFEIXH6bCHHtMPv1kt96fGKBsRtXIix42N:SFTRDxSLPSmi60pFEIXN7tYfGXW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4916	4452	rundll32.exe	84
PID 4452 wrote to memory of 4916	4452	rundll32.exe	84
PID 4452 wrote to memory of 4916	4452	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avutil-56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avutil-56.dll,#1
  2⤵
  PID:4916