fcacfcb9b89fc2a2cf20a3cbd7d6ea81a21fa938e3145893145aa9e1c9856ea8

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:17

Target

Sgi's Video Converter/MediaInfo.dll
Size

2.3MB
MD5

da13c636d67418992bba1cf576b349ab
SHA1

77ae55269ccdac7e1d83c6a108fd4c781ab5168d
SHA256

11010be8f847e99b7cfd0210e7c43db300a50b4641e2f8c66a5c56405f2d733a
SHA512

45e672730962c82b508d705f875344210cca75019a6dfd4dcb0f84b56e1fe9dfe0d4c5324de2553bde05815a610ef52704d5e93c6eb96eb876f6dd943f6fa90b
SSDEEP

49152:rWT0l+ZtLLS2uEXNseE/59jsQVL/EP1xgpHd1Dyd0aS/LXLfjTgmpRzN2HOPC:rTu2EXNsJBVsQVL/EPzgpHd1Dyd0ak

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2036	2436	rundll32.exe	30
PID 2436 wrote to memory of 2036	2436	rundll32.exe	30
PID 2436 wrote to memory of 2036	2436	rundll32.exe	30
PID 2436 wrote to memory of 2036	2436	rundll32.exe	30
PID 2436 wrote to memory of 2036	2436	rundll32.exe	30
PID 2436 wrote to memory of 2036	2436	rundll32.exe	30
PID 2436 wrote to memory of 2036	2436	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sgi's Video Converter\MediaInfo.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sgi's Video Converter\MediaInfo.dll",#1
  2⤵
  PID:2036