22b7247ac7d4b0c45798208487a1bfa0ea4c6aac185ed4fbf0bdf267fdf8ceb0

Analysis

max time kernel
136s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 23:01

Target

DPlayerGR(play.jb51.net)/QtNetwork4.dll
Size

1013KB
MD5

74b5163797992a14d0796c6e83bdd593
SHA1

6d700014b0a342c13b234c85177d2933252880f6
SHA256

5feccd7d84bb8f33e073f89c9133281673b9bc786339f247dcfb89f333a81d7a
SHA512

8ca792fc420b6d8d1c07d3238ea8c45e7dd9dc1ed6bfc5352718490a2575da4cd4ce815df2450e7101d76f230e12dea5a2b7a9dd4c8bc36b2af73e3b05d8e249
SSDEEP

12288:Y3IavftoUEhnr38IQDAbGV9eNZr9x97h5YZcxxHtp/XgZuLSSMdQO4xGqgM/x7i5:JgkVkXB9+phh+/DVpEPgC0t

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1144	5032	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3588 wrote to memory of 5032	3588	rundll32.exe	80
PID 3588 wrote to memory of 5032	3588	rundll32.exe	80
PID 3588 wrote to memory of 5032	3588	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtNetwork4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtNetwork4.dll,#1
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 652
    3⤵
    - Program crash
    PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5032 -ip 5032
1⤵
PID:4124