6c1468d28ac3c0ada79124e3a76315dc063baa891793ca145621fc54f243448c

Analysis

max time kernel
148s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 21:48

Target

ZealotAllideoConverter/All Video Converter/libavidd-1.3.2.dll
Size

28KB
MD5

720620ce74754f01c8af61b6e2c9b62d
SHA1

10e359c78d39cc017e1edbb9cbb0bd1040124a67
SHA256

dab4e30ef5410e7b6990458e1a83017e74e69874e20d5fcfb9054ed249a1c1e0
SHA512

87aa48017a9fb7d78fb29b812c56b0cebe535799f30e531bd19c1099b6eb144b6dde27484f880dafa030d0d0c56339e99ac1b4725532f8274eceb2c1167b15f4
SSDEEP

384:bp5jKRwESKvkey91xQt5ASZ5ofQ2jASZcxY:b/KJSKvkeK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	220	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 220	2536	rundll32.exe	79
PID 2536 wrote to memory of 220	2536	rundll32.exe	79
PID 2536 wrote to memory of 220	2536	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libavidd-1.3.2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libavidd-1.3.2.dll",#1
  2⤵
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 628
    3⤵
    - Program crash
    PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 220 -ip 220
1⤵
PID:1756