1606a6aa8faad26ad780f7e9d71e61f30ebeb69caa6eed3d1a5691142e090c69

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:01

Target

$COMMONFILES/QvodPlayer/Codecs/ff_theora.dll
Size

140KB
MD5

815bdbc3d392d7a87992d2159d6b2a82
SHA1

03809f446e466362d8baa720715e7120c8d0fff3
SHA256

9367a602614824d401507145071a475af02c1648a8cd5f33475e1cf75cdf84af
SHA512

c4769acb0a9ff9e5d367f575a02917840f4fc1fcd8991578e8fc17b6959afd7e20bbc7ea57a6962d57eb58fc31245809d65893ff74f2fa69ab2fad2cab84f1ad
SSDEEP

3072:0onPARBvfbLklYuk8ISecd5gntoZdVCn+rpHuzQe8Ntc5SOYZaYLuQUja5Dw:bI/vXklYL8ISe7zF8tOSbVBUja5D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2120	2076	rundll32.exe	30
PID 2076 wrote to memory of 2120	2076	rundll32.exe	30
PID 2076 wrote to memory of 2120	2076	rundll32.exe	30
PID 2076 wrote to memory of 2120	2076	rundll32.exe	30
PID 2076 wrote to memory of 2120	2076	rundll32.exe	30
PID 2076 wrote to memory of 2120	2076	rundll32.exe	30
PID 2076 wrote to memory of 2120	2076	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\QvodPlayer\Codecs\ff_theora.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\QvodPlayer\Codecs\ff_theora.dll,#1
  2⤵
  PID:2120