41bbbe806b787ebbd8f8ac5f813a00ed4b822e500ecacabcd3ff94ff21e06c24

Analysis

max time kernel
23s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 01:39

Target

DPlayer_lv/QtNetwork4.dll
Size

1013KB
MD5

74b5163797992a14d0796c6e83bdd593
SHA1

6d700014b0a342c13b234c85177d2933252880f6
SHA256

5feccd7d84bb8f33e073f89c9133281673b9bc786339f247dcfb89f333a81d7a
SHA512

8ca792fc420b6d8d1c07d3238ea8c45e7dd9dc1ed6bfc5352718490a2575da4cd4ce815df2450e7101d76f230e12dea5a2b7a9dd4c8bc36b2af73e3b05d8e249
SSDEEP

12288:Y3IavftoUEhnr38IQDAbGV9eNZr9x97h5YZcxxHtp/XgZuLSSMdQO4xGqgM/x7i5:JgkVkXB9+phh+/DVpEPgC0t

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1352	1176	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1672 wrote to memory of 1176	1672	rundll32.exe	27
PID 1672 wrote to memory of 1176	1672	rundll32.exe	27
PID 1672 wrote to memory of 1176	1672	rundll32.exe	27
PID 1672 wrote to memory of 1176	1672	rundll32.exe	27
PID 1672 wrote to memory of 1176	1672	rundll32.exe	27
PID 1672 wrote to memory of 1176	1672	rundll32.exe	27
PID 1672 wrote to memory of 1176	1672	rundll32.exe	27
PID 1176 wrote to memory of 1352	1176	rundll32.exe	28
PID 1176 wrote to memory of 1352	1176	rundll32.exe	28
PID 1176 wrote to memory of 1352	1176	rundll32.exe	28
PID 1176 wrote to memory of 1352	1176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtNetwork4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtNetwork4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 232
    3⤵
    - Program crash
    PID:1352

memory/1176-54-0x0000000000000000-mapping.dmp

Download
memory/1176-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1352-56-0x0000000000000000-mapping.dmp

Download