dfca2f1a842aea69a2b0a22ca66fa7852f86259e3da4f576f8ae7fa16f1e9134 | Triage

Analysis

max time kernel
75s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
08-07-2024 09:22

Sharing

Report Analysis Logs

General

Target

ffmpeg.dll
Size

2.4MB
MD5

8a622da2741db6fb78d739cee3c935c1
SHA1

eb6b61ee94702ef5ff80c05b785be7efe5a72df7
SHA256

669dcce2f75aa398993fee03dbd9d6f2c3790b1ecfeb8bc0bfb1bf9e43a304da
SHA512

8dc6c48c4900a03e5d3f0f168f2b1de86b7db352195d98ff17eb1b96a34ee9f4d84869c2b231384011bd2b04e3a5b0e571fc5dd34a3a8b4b798e1dd1fe99ec8d
SSDEEP

49152:nki4hphNy4D59NFNi2+g5RyGKHgwGAq0H:ki4h7D59NN8GKHVXH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2284 wrote to memory of 836	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 836	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 836	2284	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
2⤵
PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads