22b7247ac7d4b0c45798208487a1bfa0ea4c6aac185ed4fbf0bdf267fdf8ceb0

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 23:01

Target

DPlayerGR(play.jb51.net)/QtXml4.dll
Size

347KB
MD5

662b511776db4e9fb59d740cd2d18d28
SHA1

699aa8e02b605d7f74248668434e8fdc7997c5b2
SHA256

0c875b667cb90952aa628ae713644b0bbf2413aa3cfa310f8dfdabab1990e06e
SHA512

7c0f7cc3f0ee70e5682c01bb4a234d4f036fc10443d8e63605083a0528e1326a8f96bade2e4b95288a2e07e5f5f63c02f8eb44a23aee4c0d16db4380626d68d9
SSDEEP

6144:akwkS0wEgT8UQzveVai1FT7AFJvWOHSMObx8JK:akwkLwLT8BeVFfAFvs

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1328	1252	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1252 wrote to memory of 1328	1252	rundll32.exe	28
PID 1252 wrote to memory of 1328	1252	rundll32.exe	28
PID 1252 wrote to memory of 1328	1252	rundll32.exe	28
PID 1252 wrote to memory of 1328	1252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtXml4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtXml4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 228
    3⤵
    - Program crash
    PID:1328

memory/1252-54-0x0000000000000000-mapping.dmp

Download
memory/1252-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1328-56-0x0000000000000000-mapping.dmp

Download