22b7247ac7d4b0c45798208487a1bfa0ea4c6aac185ed4fbf0bdf267fdf8ceb0

Analysis

max time kernel
45s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 23:01

Target

DPlayerGR(play.jb51.net)/QtCore4.dll
Size

2.4MB
MD5

333479a7a67da81e316d4ee55682e75a
SHA1

62629b3691200a3385b765b966c5d0fce8b84fb0
SHA256

08ffea22ad878c021a46db9c1acc2b89b40371cf669a0eb0b32957d35b8963e1
SHA512

0577d03a66d06b36e9aef75915d58d8129245e537e04e298b719ff1035c5ea9719293fc4055c57480441c28946658493bdcd63659537924f595cb379a87c6462
SSDEEP

49152:t8xkQnEN/mISbJsv6tWKFdu9CRTLLyvL/6mShMZtmjNUVrciV5P+7QVg07EuIITg:ix38PyJsv6tWKFdu9Ck

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
888	988	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 948 wrote to memory of 988	948	rundll32.exe	27
PID 988 wrote to memory of 888	988	rundll32.exe	28
PID 988 wrote to memory of 888	988	rundll32.exe	28
PID 988 wrote to memory of 888	988	rundll32.exe	28
PID 988 wrote to memory of 888	988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtCore4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 228
    3⤵
    - Program crash
    PID:888

memory/888-56-0x0000000000000000-mapping.dmp

Download
memory/988-54-0x0000000000000000-mapping.dmp

Download
memory/988-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download