a346595fe9232e039e99763b5fab73cb11383d9d8ec5cbafd861e84fb376e30d

Analysis

max time kernel
175s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 11:37

Target

AMR Player/avformat.dll
Size

460KB
MD5

a1dafa2a780960f4790ab71264c23d0b
SHA1

44e3a3a06342e5824984fb5d708bdee00076388a
SHA256

f93dcafa81c3e101481b9f2d1c8064228fb10894ae8d900b49db3ea76f78923a
SHA512

e9588f6e3f81f85e39c0df1966829434d7f4aca582070b45ef5392eca2d0d0c7af95c74860d0606545fb9212aa65c13a2f63cc2915aab81ea9463348470632cf
SSDEEP

12288:ZWB6jJTck57q0+8BGS2Z0YQCK23X9GZZZ2ZF0J:IBGik5ZqS2Z0YQhE0J

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2252	4848	WerFault.exe	77
1560	4848	WerFault.exe	77

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4848	2152	rundll32.exe	77
PID 2152 wrote to memory of 4848	2152	rundll32.exe	77
PID 2152 wrote to memory of 4848	2152	rundll32.exe	77
PID 4848 wrote to memory of 1560	4848	rundll32.exe	82
PID 4848 wrote to memory of 1560	4848	rundll32.exe	82
PID 4848 wrote to memory of 1560	4848	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AMR Player\avformat.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AMR Player\avformat.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 668
    3⤵
    - Program crash
    PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 668
    3⤵
    - Program crash
    PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4848 -ip 4848
1⤵
PID:4660

memory/4848-133-0x00000000659C0000-0x0000000065A37000-memory.dmp

Filesize
476KB

Download
memory/4848-134-0x0000000066780000-0x0000000066CBF000-memory.dmp

Filesize
5.2MB

Download
memory/4848-135-0x0000000002210000-0x000000000274F000-memory.dmp

Filesize
5.2MB

Download
memory/4848-136-0x0000000002210000-0x000000000274F000-memory.dmp

Filesize
5.2MB

Download