04d1ffad25e9541cf1c0d2a054aba4b2cd2ca03c764cbf62bf8900cb92a38221

Analysis

max time kernel
40s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:12

Target

TheWorldPortable/Application/6.2.0.128/ffmpegsumo.dll
Size

1.6MB
MD5

56fac7aaa5b2c58ba9688c014e5d9946
SHA1

78e88a5582148b6920e24d4eac77278ec106296b
SHA256

c1e96acde8190370e367ee834e9b58a12d6004e48e952a682abdd7c54b409126
SHA512

fcd811991cf5459a78ff4587f3fbf3e8b2368e0f90009213994cefab53fa92221492e1d872d7476ada47ed47dd7d600c094befb2a371d0168db64db05212a49a
SSDEEP

49152:BfJzYYcNfuM3KRizrUJBWGFNliT4fpDre/1CuCg+bK8b:zMYcNfp6RPJj5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1160	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1160 wrote to memory of 2012	1160	rundll32.exe	28
PID 1160 wrote to memory of 2012	1160	rundll32.exe	28
PID 1160 wrote to memory of 2012	1160	rundll32.exe	28
PID 1160 wrote to memory of 2012	1160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\ffmpegsumo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\ffmpegsumo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 224
    3⤵
    - Program crash
    PID:2012

memory/1160-54-0x0000000000000000-mapping.dmp

Download
memory/1160-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/2012-56-0x0000000000000000-mapping.dmp

Download