af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 10:37

Target
FFModules/RMCodecs/tools/rnvideopacketizer.dll
Size 29KB
Sample240612-mn9zaavepr
SHA256 7550e57bce1d84203296e43ea33d68b75d8015743e3e1d093c2ff9e95a6e00ed
MD5 5a75d9266b5a6b63487a559f0cdee019
SHA1 a39d79c4addadf5e3b518b208f764f983b376065
SHA512 c656af319f7eba674bb910a676cb20d049dbb777dea0a7fe0e19861ad9c9404a938419ab36af5d683dc78f28f4123fa9c13ba689e219a073a2bf76f8492e09f1
SSDEEP 768:x9Z98z3cPLA2vLT9BwrBTY94hNtk8xjeF:NA3cPE2vLRCrBE9yKMe
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\rnvideopacketizer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\rnvideopacketizer.dll,#1
  2⤵
  PID:2848