af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:37

Target
FFModules/RMCodecs/tools/videolumaadj.dll
Size 30KB
Sample240612-mn9zaavepr
SHA256 8a39dee42fca022c0730f9eba106f3b9f018f13cf4122b56f48ef1e869b7b0df
MD5 f7a26c4ea28eb97500ee6c7edd99444b
SHA1 66717750d853ab4b89bfe97e9d9d3ab8d7b74724
SHA512 f8a98652d9565eee6932c7e5899a9e9cc64f1fbbe4bdab4f32a55f9398ec4b593ae1a77b9bfc5eafc556d865433790498af0f0cc358b7ec03793455f6944a851
SSDEEP 384:/chHGNdcxQ2wKq8xglRwUUQqID0Bo8OqgtxjN0vnE3PTz5ogfGruNN7:3d0RwKBLQnoZO7hNQE98k
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3444	5036	rundll32.exe	82
PID 5036 wrote to memory of 3444	5036	rundll32.exe	82
PID 5036 wrote to memory of 3444	5036	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\videolumaadj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\videolumaadj.dll,#1
  2⤵
  PID:3444