a346595fe9232e039e99763b5fab73cb11383d9d8ec5cbafd861e84fb376e30d

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 11:37

Target

AMR Player/avformat.dll
Size

460KB
MD5

a1dafa2a780960f4790ab71264c23d0b
SHA1

44e3a3a06342e5824984fb5d708bdee00076388a
SHA256

f93dcafa81c3e101481b9f2d1c8064228fb10894ae8d900b49db3ea76f78923a
SHA512

e9588f6e3f81f85e39c0df1966829434d7f4aca582070b45ef5392eca2d0d0c7af95c74860d0606545fb9212aa65c13a2f63cc2915aab81ea9463348470632cf
SSDEEP

12288:ZWB6jJTck57q0+8BGS2Z0YQCK23X9GZZZ2ZF0J:IBGik5ZqS2Z0YQhE0J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	1756	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1556 wrote to memory of 1756	1556	rundll32.exe	27
PID 1756 wrote to memory of 1340	1756	rundll32.exe	28
PID 1756 wrote to memory of 1340	1756	rundll32.exe	28
PID 1756 wrote to memory of 1340	1756	rundll32.exe	28
PID 1756 wrote to memory of 1340	1756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AMR Player\avformat.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AMR Player\avformat.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 252
    3⤵
    - Program crash
    PID:1340

memory/1756-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1756-56-0x00000000659C0000-0x0000000065A37000-memory.dmp

Filesize
476KB

Download
memory/1756-58-0x0000000066780000-0x0000000066CBF000-memory.dmp

Filesize
5.2MB

Download