41bbbe806b787ebbd8f8ac5f813a00ed4b822e500ecacabcd3ff94ff21e06c24

Analysis

max time kernel
107s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 01:39

Target

DPlayer_lv/QtCore4.dll
Size

2.4MB
MD5

333479a7a67da81e316d4ee55682e75a
SHA1

62629b3691200a3385b765b966c5d0fce8b84fb0
SHA256

08ffea22ad878c021a46db9c1acc2b89b40371cf669a0eb0b32957d35b8963e1
SHA512

0577d03a66d06b36e9aef75915d58d8129245e537e04e298b719ff1035c5ea9719293fc4055c57480441c28946658493bdcd63659537924f595cb379a87c6462
SSDEEP

49152:t8xkQnEN/mISbJsv6tWKFdu9CRTLLyvL/6mShMZtmjNUVrciV5P+7QVg07EuIITg:ix38PyJsv6tWKFdu9Ck

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1064	1224	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1348 wrote to memory of 1224	1348	rundll32.exe	28
PID 1348 wrote to memory of 1224	1348	rundll32.exe	28
PID 1348 wrote to memory of 1224	1348	rundll32.exe	28
PID 1348 wrote to memory of 1224	1348	rundll32.exe	28
PID 1348 wrote to memory of 1224	1348	rundll32.exe	28
PID 1348 wrote to memory of 1224	1348	rundll32.exe	28
PID 1348 wrote to memory of 1224	1348	rundll32.exe	28
PID 1224 wrote to memory of 1064	1224	rundll32.exe	29
PID 1224 wrote to memory of 1064	1224	rundll32.exe	29
PID 1224 wrote to memory of 1064	1224	rundll32.exe	29
PID 1224 wrote to memory of 1064	1224	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtCore4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 228
    3⤵
    - Program crash
    PID:1064

memory/1064-56-0x0000000000000000-mapping.dmp

Download
memory/1224-54-0x0000000000000000-mapping.dmp

Download
memory/1224-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download