6c1468d28ac3c0ada79124e3a76315dc063baa891793ca145621fc54f243448c

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:48

Target

ZealotAllideoConverter/All Video Converter/libfilefmt-1.4.7.dll
Size

3.2MB
MD5

7dfc4512ad8f1febd65b1f1b9a7c2f8f
SHA1

1d0708a36281f1baef5b7e66a4c420b8f29c264b
SHA256

17154a1f78d12683f9e2758da951f51dec39c859ce56d2d3e7ec58696cd9185d
SHA512

3932f4b01529ac9abf83229373085c3acdb89a9341f903016848ad39ab3369738c6f7f4c7f1ecaed3341122b511b088707991bc6e5699446df4254ab2f3fe49a
SSDEEP

98304:QddVvEmIO7CFwc8tz3k3Ay9YKPa4TMoItu:QdfvEmX7YwBz3+Ay9Yqa4o1tu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1172	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28
PID 1172 wrote to memory of 1696	1172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libfilefmt-1.4.7.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libfilefmt-1.4.7.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 228
    3⤵
    - Program crash
    PID:1696

memory/1172-55-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download