1606a6aa8faad26ad780f7e9d71e61f30ebeb69caa6eed3d1a5691142e090c69

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 17:01

Target

$COMMONFILES/QvodPlayer/Codecs/ff_realaac.dll
Size

95KB
MD5

f3564a98176f4511fad0fa8d5930f826
SHA1

b067b26858daa2342fdd94ed03047480644c1702
SHA256

b55fe6c8e12706de18cee83461e3ce9264a8403a64f55b0eabf69733ba42439a
SHA512

c9b5f325f1d11692255ca0fbc0396c96beedb107cebf1223bd69d16c7d2b6088685dc104cb9e87ed5e1baaed3d189f11568b74f25fa36c0de41450bba2de34f3
SSDEEP

1536:nRBzZIk+lN3LEwzW8Dkp7G74kGmSJsKs1b52OLS68dx7bEFwmv3PpVn/qVDbPSKU:LZInlN7EYQABGIAOLcEqmvL/IPSfuttt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1192	2132	rundll32.exe	85
PID 2132 wrote to memory of 1192	2132	rundll32.exe	85
PID 2132 wrote to memory of 1192	2132	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\QvodPlayer\Codecs\ff_realaac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\QvodPlayer\Codecs\ff_realaac.dll,#1
  2⤵
  PID:1192