af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
50s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:37

Target
FFModules/RMCodecs/tools/videoresizer.dll
Size 40KB
Sample240612-mn9zaavepr
SHA256 c30302fe3fa73efb4632f50b3362258b2645001f704b52325d93212b97d4bde3
MD5 8c58da0f2b44f43c2f0518b881e9df28
SHA1 09a1670967fe1baeedaaaca49f519c91e4cda302
SHA512 27f5c43238d2dffe54b6babc102f3553016aac5caf183ff0e4d0446aca38f6161ae91e7293a8207706664e6da203c720f29f7655ccaa47b965629d748101e9b3
SSDEEP 768:/oksyLBMaHOZe6MRCA/aG2IW1QL4qNfasCPaya:bzFMQOZZMUMx2HaL4YfasC1a
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 2892	3744	rundll32.exe	83
PID 3744 wrote to memory of 2892	3744	rundll32.exe	83
PID 3744 wrote to memory of 2892	3744	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\videoresizer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\videoresizer.dll,#1
  2⤵
  PID:2892