b931be51f58aefde0a308963de518204d7ea7422b752ddbd96d22119516d0d47 | Triage

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 20:37

Sharing

Report Analysis Logs

General

Target

ffmpeg.dll
Size

2.5MB
MD5

db7974db8af148508cab4ce2017e8b1f
SHA1

48c81f39f0e2223aa0b110a3474bd8d0213d8760
SHA256

2f1d4a76994c2defd144ff1f2e7c64b8bd028d197994403b135f97657410980a
SHA512

2450420be11ed84fb2a533128475d51e83573085e8f4de43ff9390bfde08ae9f7e35a19079bb8d085d9f55d9e32ecfe6bd2695760e46f3363a210a6292cc938f
SSDEEP

49152:OqXk9OqD0uQqLdi1n8r8dES75xFAgelEeTPCJYGgkMY:1oOqHhsAgQEeTPCok

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2220 wrote to memory of 2212	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2212	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2212	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2212	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2212	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2212	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2212	2220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
2⤵
PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads