6c1468d28ac3c0ada79124e3a76315dc063baa891793ca145621fc54f243448c

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:48

Target

ZealotAllideoConverter/All Video Converter/libavidd-1.3.2.dll
Size

28KB
MD5

720620ce74754f01c8af61b6e2c9b62d
SHA1

10e359c78d39cc017e1edbb9cbb0bd1040124a67
SHA256

dab4e30ef5410e7b6990458e1a83017e74e69874e20d5fcfb9054ed249a1c1e0
SHA512

87aa48017a9fb7d78fb29b812c56b0cebe535799f30e531bd19c1099b6eb144b6dde27484f880dafa030d0d0c56339e99ac1b4725532f8274eceb2c1167b15f4
SSDEEP

384:bp5jKRwESKvkey91xQt5ASZ5ofQ2jASZcxY:b/KJSKvkeK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1972	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1972 wrote to memory of 1928	1972	rundll32.exe	28
PID 1972 wrote to memory of 1928	1972	rundll32.exe	28
PID 1972 wrote to memory of 1928	1972	rundll32.exe	28
PID 1972 wrote to memory of 1928	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libavidd-1.3.2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libavidd-1.3.2.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 252
    3⤵
    - Program crash
    PID:1928

memory/1972-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download