af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 10:37

Target
FFModules/RMCodecs/tools/videoprogressive.dll
Size 60KB
Sample240612-mn9zaavepr
SHA256 41e1ee125e4c3847e08b66562ce6cfa53a1995e2a716ee57c627ddbb56aac8ca
MD5 6e8b4a521f63ac0bc09557be686f33ba
SHA1 a4f81ca35373304e5ae06bad05da5f0960626b00
SHA512 613682de2c6e648b7bf1bcf8ae4d5cd06aff55c12aa3c31aa6e11a8807b01bfe1f18b1fe71b6e8328a3221f3c4fd5822c210f7ce5dba5d17e764c6dddc5053ed
SSDEEP 768:ongLG7JYj2Ezz+kxsshJKLSHCDMMmf+u1bicXDIb0TNyPW+c:xy7JYjPFjRCDMMmfjb7Ub4yu+c
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\videoprogressive.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\videoprogressive.dll,#1
  2⤵
  PID:2380