fcacfcb9b89fc2a2cf20a3cbd7d6ea81a21fa938e3145893145aa9e1c9856ea8

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:17

Target

Sgi's Video Converter/pthreadGC2.dll
Size

52KB
MD5

d740f9388f57ca98272aa88cf24780e9
SHA1

d6c39211730223a6e3a6cf5bcbf760c27cc70e8f
SHA256

3fa5bfa3794cb1b2f403b9b37356a2f2f211863d1548be094a03b09460758930
SHA512

7f61641dcbad18a45041c439fc8102029872ea37370ee3944a16fb9d9478554741f46c90fcb03eca7b67b74b260022e4fe7205b5df9e2274f834f74409cd0a93
SSDEEP

1536:tpW2QO71+ScPKKxdnouy8El5iH3YFPJhrQ8ubZt:tpQOVcxloutEHiH3YFPJhrQ8KD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sgi's Video Converter\pthreadGC2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sgi's Video Converter\pthreadGC2.dll",#1
  2⤵
  PID:1864

memory/1864-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/1864-3-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/1864-2-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/1864-1-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download