af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
141s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:37

Target
FFModules/RMCodecs/tools/rnvideocodec.dll
Size 104KB
Sample240612-mn9zaavepr
SHA256 51e45073d1b0969ebcec53b66684f7d7818642b4398dfefb8c22ac44c8a5c324
MD5 9db7e494069aa2281063c796f90bad95
SHA1 1be17bc2a806215e5aa2cb76cbc8f5d3e5852c3c
SHA512 0a16e0174f5764d710f977397a28f5ff035000f2a11ca1232981582738f24c2ef179e7da1e39c69c1e23c89cd96bac9cbc82112afe60a9b73b5bbba35cb3f4eb
SSDEEP 1536:96jbk/mYTEr3K0+BNXSzmCemRyXtv/eVpqg4PM/3kcY9ewDeTQQCy0BhxbKBmLeN:UbkZ4r3+Bo/IdXnM/UNvKTIxbKBmLeN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4688	3892	rundll32.exe	89
PID 3892 wrote to memory of 4688	3892	rundll32.exe	89
PID 3892 wrote to memory of 4688	3892	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\rnvideocodec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\rnvideocodec.dll,#1
  2⤵
  PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:1168