c5a44b3d265b10212fe02cc581453d1fe751d30091282e1e2217c73ab196a232

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 15:00

Target

resources/app/WidevineCdm/4.10.2710.0/_platform_specific/win_x86/widevinecdm.dll
Size

17.0MB
MD5

4bf760b972b1d1d70344bf489e5e75c5
SHA1

d73ea7becce3fc5a4237179a66c41a6514313926
SHA256

a8bf930f7e59088f13c2ae3a891ceb00fb52492323b10f4ad0ece73c476d39c2
SHA512

b7d3a6ee29f5c0aa28943f38148c65ac55c4d9b6ce6b5dcd52607ebad3cd2708a9cbf0e7aca2c9cd9f781fb01a712f6d2123ca2720561ce5cbdb82b16f075b9b
SSDEEP

393216:QTiIK/1X5loiNKy7AG7GmjGqapjhxBuxqd2D3CR8OeY8Fkcn:N1oy737tapj/BusN8nfDn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1956 wrote to memory of 3224	1956	rundll32.exe	83
PID 1956 wrote to memory of 3224	1956	rundll32.exe	83
PID 1956 wrote to memory of 3224	1956	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app\WidevineCdm\4.10.2710.0\_platform_specific\win_x86\widevinecdm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app\WidevineCdm\4.10.2710.0\_platform_specific\win_x86\widevinecdm.dll,#1
  2⤵
  PID:3224