4c736d1faacebb84bd437e13ebf1d1c0d615e1aabe55a0444d5d290a9e8d5c7c | Triage

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 21:33

Sharing

Report Analysis Logs

General

Target

ffmpeg.dll
Size

2.5MB
MD5

df21af58b55d1a2e6c2e176e29695d9a
SHA1

cd1ebb1639ca91035b3e8d8361a413865066c4fe
SHA256

c7170c2f072cd2cdc21ab93ca39034246b94fdf408347602427140a0a8e37543
SHA512

d62cfb9c163193de4b97750ae9c9e122f96abd6e524e0318d343f15231062250fe00aaf9c8a8e8112e0072a8fb30ac0b07c4413488de5a553d6afafd8a36e574
SSDEEP

49152:+tGX4mOrucp9DHNj8CvJhAbEfvWyZOjp+:EGobp9DHNVvJhAAfCd+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2396 wrote to memory of 224	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 224	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 224	2396	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
2⤵
PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads