0058b4f69b0e6b9fc2eaca10a9bfb41e72e6cd72a827f8740fefde876194bade

Analysis

max time kernel
28s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 02:29

Target

PowerISO/App/PowerISO64/lame_enc.dll
Size

369KB
MD5

3ddbe1ba218722dff684f83d86299807
SHA1

267b1f9829e9c2a508a9dd564a9dde6d373123f0
SHA256

89d12c8147b36344647d4ffd109ff8d237d9c0c88194048f842ca97a3b079c97
SHA512

e415d7ebc5a00e8ee4d4a7b8294924aab8eaa3cda3d0ad46d8546494a5965e28d1dfe5710c1cb0d5c3a9f5b9c1b60243227217d71ea49187077492746632cbf3
SSDEEP

6144:8cUdD9kke1LoEpkqNdnDRjX0cBPkd3zujZx7Y3eg8gAoeR1DOWtoUqoTE6LEU4Gi:8cUdD9kkKJpdnDRjX0cBPkd3zujZlY3/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1316	1252	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1316	1252	rundll32.exe	27
PID 1252 wrote to memory of 1316	1252	rundll32.exe	27
PID 1252 wrote to memory of 1316	1252	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\lame_enc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1252 -s 84
  2⤵
  - Program crash
  PID:1316