22b7247ac7d4b0c45798208487a1bfa0ea4c6aac185ed4fbf0bdf267fdf8ceb0

Analysis

max time kernel
189s
max time network
239s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 23:01

Target

DPlayerGR(play.jb51.net)/QtCore4.dll
Size

2.4MB
MD5

333479a7a67da81e316d4ee55682e75a
SHA1

62629b3691200a3385b765b966c5d0fce8b84fb0
SHA256

08ffea22ad878c021a46db9c1acc2b89b40371cf669a0eb0b32957d35b8963e1
SHA512

0577d03a66d06b36e9aef75915d58d8129245e537e04e298b719ff1035c5ea9719293fc4055c57480441c28946658493bdcd63659537924f595cb379a87c6462
SSDEEP

49152:t8xkQnEN/mISbJsv6tWKFdu9CRTLLyvL/6mShMZtmjNUVrciV5P+7QVg07EuIITg:ix38PyJsv6tWKFdu9Ck

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
456	1140	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1948 wrote to memory of 1140	1948	rundll32.exe	81
PID 1948 wrote to memory of 1140	1948	rundll32.exe	81
PID 1948 wrote to memory of 1140	1948	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtCore4.dll,#1
  2⤵
  PID:1140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 648
    3⤵
    - Program crash
    PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1140 -ip 1140
1⤵
PID:3552