af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:37

Target
FFModules/RMCodecs/tools/videonoisefilter.dll
Size 40KB
Sample240612-mn9zaavepr
SHA256 b05c3bb90cd1a61b0e1d824d52c1115f5517b2492bf754be63fcf2933db27c4a
MD5 74904e8f8f23b7ff1efc1ae5e3883ca7
SHA1 05b623ce3bb0d67e17dcdeaf0af90dc87f611153
SHA512 62f5e613d4fb03f4684e8df4804a4d78cf42c524fb9ab82b18bb328a7fd75505835035f1411001e1e7a14110eebee280d5b15c292581f2f4a1d47291854a48c3
SSDEEP 384:IHLoaZ96AfeEtKCN7IdWNePljSEWbVxzhbPDQVzJ0yIW09YSSuWlQ16yqhFfN01v:IrZoAZuWEl4bVxlbyobSFQifNk8/va
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1616	2852	rundll32.exe	83
PID 2852 wrote to memory of 1616	2852	rundll32.exe	83
PID 2852 wrote to memory of 1616	2852	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\videonoisefilter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\videonoisefilter.dll,#1
  2⤵
  PID:1616