3c90b3d32f3fe37632edfad2b768cf77d70e7de0d3291d0e5274ea8a7dc69141

Analysis

max time kernel
43s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 19:44

Target

Slither x32y 64/ffmpeg.dll
Size

1003KB
MD5

843d0b77ad0f97abdbf1c35f80ddf817
SHA1

fa26030bd8f6d6a1da7e45c996eb2546580d7d4a
SHA256

69db97f02c0ec74d90c9271c606e0de27c5c64e364c5d016fba1bd5dfc8a7236
SHA512

783080f7f4bd642c2c053b3e1eca1870dc46a4e3742b9ef24de12d128ec34680749719dec33353f964cd79e6c0fd750a6471722b1a3c9afe89663788d002388b
SSDEEP

12288:uP1N1ouo5xthlk6nLXRnqm12d/eO7PB7vApFU3utrM0f4+ZqsaEeY0:jxjlPp1ySFxVf4+n+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	1776	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1776	1344	rundll32.exe	27
PID 1344 wrote to memory of 1776	1344	rundll32.exe	27
PID 1344 wrote to memory of 1776	1344	rundll32.exe	27
PID 1344 wrote to memory of 1776	1344	rundll32.exe	27
PID 1344 wrote to memory of 1776	1344	rundll32.exe	27
PID 1344 wrote to memory of 1776	1344	rundll32.exe	27
PID 1344 wrote to memory of 1776	1344	rundll32.exe	27
PID 1776 wrote to memory of 2044	1776	rundll32.exe	28
PID 1776 wrote to memory of 2044	1776	rundll32.exe	28
PID 1776 wrote to memory of 2044	1776	rundll32.exe	28
PID 1776 wrote to memory of 2044	1776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\ffmpeg.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\ffmpeg.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 224
    3⤵
    - Program crash
    PID:2044

memory/1776-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download