37115878c12ddfa17f6a49d8ff2a9778a5deaa0cbf2de0909bf689410dce1d8f

Analysis

max time kernel
0s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/09/2022, 10:17

Target

Unlock{Full_Version}/bin/win32/ffmpegsumo.dll
Size

963KB
MD5

8d6c1353081a166c15ab31ee83906c8e
SHA1

40283ef8b4343553ecf0e6e8aa4170081467bffc
SHA256

564ad57d50ffe96efd0b274a8faf94fe578819405abfc26e2d3d8d092bb465f5
SHA512

2a9737b940d330285c7040cb3e7753f33a4083f0a8a1ec3e487a9ada312f986115ca51a538abe256a735b680a19f410907bf00e2d70638706764bf2a7d52bd04
SSDEEP

12288:shP1NwYxY4gGZF1xdFNT1Ygx+iP/U7Okow2p4mDJbWYmlna7MlPM+fCI1MIx1oU8:s9gkjxdFNT1YC+UEHowA4mdb/AM+3P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	1808	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1808	940	rundll32.exe	27
PID 940 wrote to memory of 1808	940	rundll32.exe	27
PID 940 wrote to memory of 1808	940	rundll32.exe	27
PID 940 wrote to memory of 1808	940	rundll32.exe	27
PID 940 wrote to memory of 1808	940	rundll32.exe	27
PID 940 wrote to memory of 1808	940	rundll32.exe	27
PID 940 wrote to memory of 1808	940	rundll32.exe	27
PID 1808 wrote to memory of 948	1808	rundll32.exe	28
PID 1808 wrote to memory of 948	1808	rundll32.exe	28
PID 1808 wrote to memory of 948	1808	rundll32.exe	28
PID 1808 wrote to memory of 948	1808	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Unlock{Full_Version}\bin\win32\ffmpegsumo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Unlock{Full_Version}\bin\win32\ffmpegsumo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 224
    3⤵
    - Program crash
    PID:948

memory/1808-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download