b16b2bb2cf65357f42f046e187a668cc9ddaf564f0d14e766b55404be97c9686 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 04:52

Sharing

Report Analysis Logs

General

Target

ffmpeg.dll
Size

2.5MB
MD5

df465dee9ea3d7de433b9d1bcdb63572
SHA1

8ab9e68b4f472715177c45992cb2d7c40dec7a6a
SHA256

1a49d1d4b536101a94844e95479803d4f792f2fb41af98a0d0532006546fc9bf
SHA512

82d1e4ce427a8e987c3e84991126510883110d6f73b082b78180077a2d149eb1e0b6511f9659a8a5843f74d554daac9445373e98ede2b4b717126022e8493823
SSDEEP

49152:GtGX4mOrucp9DHNj8CvJhAbEfvWyZOjpP:sGobp9DHNVvJhAAfCdP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1692 wrote to memory of 1380	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
2⤵
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads