399e4f74e920566da0d84693c9c520f1d3c1a494c809d90ce6cdcc52b4b669c4

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 05:59

Target

LAVFilters64/avutil-lav-59.dll
Size

1.0MB
MD5

1927888c96fc581151469026ebe647bb
SHA1

c12078093bebdb6a9a71ed22401a2aae31857acf
SHA256

fe6400f844e245fca80fb4640d63b4c073ea5f37a9bfab8b7400124c2ac769d1
SHA512

09f32539cd1f6c621556fdb9b39de3ee6096a29ec4e59dd5e3c11802b7a3182095a858759147e32d261bb79fe3e5b5215ce0158ee03a64ff9839dc63ecb50f91
SSDEEP

24576:NtsbRsaYwm8HzVTDoNLLxXjI6gEBH2PPN8//f8xr04N6d+:NtstPYwmQhINLLxzI6gEBH2PPN8//f8J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2520	1700	rundll32.exe	30
PID 1700 wrote to memory of 2520	1700	rundll32.exe	30
PID 1700 wrote to memory of 2520	1700	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LAVFilters64\avutil-lav-59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1700 -s 96
  2⤵
  PID:2520

memory/1700-0-0x000007FEF4AF0000-0x000007FEF5C0C000-memory.dmp

Filesize
17.1MB

Download