2a29407a012be17087edc4de06d1c4ae96f72ae52097aaa98bc2707d7d7624c7

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 01:22

Target
Plugins/FFmpeg.dll
Size 4.2MB
Sample240612-brbecaxenc
SHA256 fa49a2f6f1e1cc710bdda167b5bc0ae8f9fc4bcb50051864a719237dcc920607
MD5 205257b906b1b84beaabc01e9191deef
SHA1 94c12b955b1292bc5294f7b3280e471a588bb5b4
SHA512 403a15cc19274e3cf3f9369cc85b5dd3cf6584d36ff103cfe09b00b7405b1553767abf056a6f5793617eae515f2003697960d290affe17f69a84169ca2636264
SSDEEP 49152:hZZZQDDcpcPqWtaJehWa97nKFB73MJrQyHzhwmYsbM6XNWS/GI:hZZZig5qZDrAS/p
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1824	1252	rundll32.exe	28
PID 1252 wrote to memory of 1824	1252	rundll32.exe	28
PID 1252 wrote to memory of 1824	1252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FFmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1252 -s 88
  2⤵
  PID:1824

memory/1252-0-0x000000006CA00000-0x000000006CEBC000-memory.dmp

Download