ab4a56c15a295dda8f74a63cd34c4c7d7e770b5687fe6a346ea081f12dd7aeff

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 00:41

Target

avutil-58.dll
Size

1.1MB
MD5

3b4c22de6f362de84dacc88e0364d9d9
SHA1

1dbfba52779c21cdc62925ddf674590a70820d70
SHA256

c3640ab93291f23e5a8a0ceca51f780aafd11668212357a1a683cfdc088fe6f2
SHA512

6d394de18a68226f1b2f1f612e0a312e7e334a97b2e5781ad0662ca2346b8c7537160245b154f0f49afa735550de5d83faa6fb305e7ff9723ec7884666b82d47
SSDEEP

12288:IPUSmqd8Uo0CHkBi3y9OmMlpftKFqEhspYgptNJqVXldoKRbMTxGLGW9:IPUSDd8USi8mMlpFKFqEhRg+xzWuGW9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2640	2084	rundll32.exe	31
PID 2084 wrote to memory of 2640	2084	rundll32.exe	31
PID 2084 wrote to memory of 2640	2084	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avutil-58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2084 -s 96
  2⤵
  PID:2640