1606a6aa8faad26ad780f7e9d71e61f30ebeb69caa6eed3d1a5691142e090c69

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:01

Target

$COMMONFILES/QvodPlayer/Codecs/ff_liba52.dll
Size

36KB
MD5

01092fc2f8af2cbe9b81fca494f1d6ca
SHA1

fca82f39e86f2a299428402a14b78fa54e80340b
SHA256

a36afb98930a32fe40c7dc6b1d81069f2ad824ffad397f7ef9942087380b3042
SHA512

cf7f4f1767652d5ed89181273166f643adca0e9827248bab32b6a29880d29a56b0c4145a0342524d4135999ee97a5a4bd315c478fd819cd8e7f52727b29400ce
SSDEEP

768:WeFw26VwKJ8f9B+P1rtqQ93XSCBvb5Heghl5:fw26VwK+9GtP9nSyb5Heg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2004	2092	rundll32.exe	30
PID 2092 wrote to memory of 2004	2092	rundll32.exe	30
PID 2092 wrote to memory of 2004	2092	rundll32.exe	30
PID 2092 wrote to memory of 2004	2092	rundll32.exe	30
PID 2092 wrote to memory of 2004	2092	rundll32.exe	30
PID 2092 wrote to memory of 2004	2092	rundll32.exe	30
PID 2092 wrote to memory of 2004	2092	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\QvodPlayer\Codecs\ff_liba52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\QvodPlayer\Codecs\ff_liba52.dll,#1
  2⤵
  PID:2004