af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:37

Target
FFModules/RMCodecs/tools/rmtools.dll
Size 332KB
Sample240612-mn9zaavepr
SHA256 b26405738feb2fa2685c94d6d5472fd8fac066055d4ebb20d064ef8b32305b70
MD5 ee9db024f9483ba7b2804b4da78fbb4f
SHA1 c22f0f74fde925f9c4ce17ea90fd318bca7211b7
SHA512 19dea24e6bac1d77d3ff27bd4a18756d79809cdf03bba13f3ac7b9d42e72d9b4181b567442dfffc814ddee43ccfdf87e7941004819600af43a3ba89038f2dc01
SSDEEP 6144:FKI/6m+ZCqAbLcyKrn2QdOjF4dI4nhKRwSbqWl7Dg+PKbjjBbk3Ccs0WMkBsla/U:FKI/6m+ZCqAblcn2QdOjF4dI4nhKRwSc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2308	4812	rundll32.exe	81
PID 4812 wrote to memory of 2308	4812	rundll32.exe	81
PID 4812 wrote to memory of 2308	4812	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\rmtools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\rmtools.dll,#1
  2⤵
  PID:2308