22b7247ac7d4b0c45798208487a1bfa0ea4c6aac185ed4fbf0bdf267fdf8ceb0

Analysis

max time kernel
22s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 23:01

Target

DPlayerGR(play.jb51.net)/QtNetwork4.dll
Size

1013KB
MD5

74b5163797992a14d0796c6e83bdd593
SHA1

6d700014b0a342c13b234c85177d2933252880f6
SHA256

5feccd7d84bb8f33e073f89c9133281673b9bc786339f247dcfb89f333a81d7a
SHA512

8ca792fc420b6d8d1c07d3238ea8c45e7dd9dc1ed6bfc5352718490a2575da4cd4ce815df2450e7101d76f230e12dea5a2b7a9dd4c8bc36b2af73e3b05d8e249
SSDEEP

12288:Y3IavftoUEhnr38IQDAbGV9eNZr9x97h5YZcxxHtp/XgZuLSSMdQO4xGqgM/x7i5:JgkVkXB9+phh+/DVpEPgC0t

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1456	1724	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	28
PID 1724 wrote to memory of 1456	1724	rundll32.exe	29
PID 1724 wrote to memory of 1456	1724	rundll32.exe	29
PID 1724 wrote to memory of 1456	1724	rundll32.exe	29
PID 1724 wrote to memory of 1456	1724	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtNetwork4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtNetwork4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 232
    3⤵
    - Program crash
    PID:1456

memory/1456-56-0x0000000000000000-mapping.dmp

Download
memory/1724-54-0x0000000000000000-mapping.dmp

Download
memory/1724-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download