66d98baccf204383ee64d744e01305be78428acb6218042f8bdea6bcda82a8b6 | Triage

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 17:26

Sharing

Report Analysis Logs

General

Target

Plugins/FFmpeg.dll
Size

4.2MB
MD5

205257b906b1b84beaabc01e9191deef
SHA1

94c12b955b1292bc5294f7b3280e471a588bb5b4
SHA256

fa49a2f6f1e1cc710bdda167b5bc0ae8f9fc4bcb50051864a719237dcc920607
SHA512

403a15cc19274e3cf3f9369cc85b5dd3cf6584d36ff103cfe09b00b7405b1553767abf056a6f5793617eae515f2003697960d290affe17f69a84169ca2636264
SSDEEP

49152:hZZZQDDcpcPqWtaJehWa97nKFB73MJrQyHzhwmYsbM6XNWS/GI:hZZZig5qZDrAS/p

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 1800	352	rundll32.exe	30
PID 352 wrote to memory of 1800	352	rundll32.exe	30
PID 352 wrote to memory of 1800	352	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FFmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 352 -s 88
  2⤵
  PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/352-0-0x000000006CA00000-0x000000006CEBC000-memory.dmp

Filesize
4.7MB

Download