73afa2c6f03988437e110378a01663641ce68389145da4eb64237cbdf00d3468

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 21:03

Target

mmpack/App/imageformats/mediaservice/cc/qjpeg.dll
Size

323KB
MD5

ea85b6bfc6f6bf1c9ae2f14a03cb7503
SHA1

7ad8d94683ca3d80ac5789fde6e4fa2c4ab8869c
SHA256

dede0ec14d4fd310f9aed0a81ff36063099915a093e6729d878da3cbbbc7a54b
SHA512

313cb3a6a241dc4e8f123ad8a57d91ea4ad119b70a8f8ff5ea9857002d48cedc2d59d1687087ae33449860b573d14e0a6800c3dccb51743a0eb32ec127900dbb
SSDEEP

3072:PjJXnHEpy9ih8dHODa93qetVZl7SCgSaemhwV/b2V+P6OyidpGSUhd1GDRj/xawf:bJXHLjEYiOyizR1j/xatBYeV3Gt5SE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2920	2860	rundll32.exe	28
PID 2860 wrote to memory of 2920	2860	rundll32.exe	28
PID 2860 wrote to memory of 2920	2860	rundll32.exe	28
PID 2860 wrote to memory of 2920	2860	rundll32.exe	28
PID 2860 wrote to memory of 2920	2860	rundll32.exe	28
PID 2860 wrote to memory of 2920	2860	rundll32.exe	28
PID 2860 wrote to memory of 2920	2860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mmpack\App\imageformats\mediaservice\cc\qjpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mmpack\App\imageformats\mediaservice\cc\qjpeg.dll,#1
  2⤵
  PID:2920