c5a44b3d265b10212fe02cc581453d1fe751d30091282e1e2217c73ab196a232 | Triage

Analysis

max time kernel
130s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 15:00

Sharing

Report Analysis Logs

General

Target

ffmpeg.dll
Size

2.5MB
MD5

cbad26df4ae9dd9e05577edc9c4fa391
SHA1

d070dd217ad0c1486ed0ebddb07cfe3b337f5a79
SHA256

25628eebfb11819ed9e11cad7e91e8daf14fa482aacb6e0468a093824d0fcdfd
SHA512

714cd167b29e1310e425db2c9ecdc61c57d5ea3eb41e21b099c7a6de4865fabffd096dd01cb91036a1749dadb718f9f9c55b567a592cf10e91276a92ba940ee9
SSDEEP

49152:RLODafMIUtBm7EuhoUNCCxi4pmJDXhKWXt5dBbj:RRfOtBQEqNCCxi4kJDRKmd9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4760 wrote to memory of 1368	4760	rundll32.exe	84
PID 4760 wrote to memory of 1368	4760	rundll32.exe	84
PID 4760 wrote to memory of 1368	4760	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
  2⤵
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads