3c90b3d32f3fe37632edfad2b768cf77d70e7de0d3291d0e5274ea8a7dc69141

Analysis

max time kernel
89s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2023 19:44

Target

Slither x32y 64/ffmpeg.dll
Size

1003KB
MD5

843d0b77ad0f97abdbf1c35f80ddf817
SHA1

fa26030bd8f6d6a1da7e45c996eb2546580d7d4a
SHA256

69db97f02c0ec74d90c9271c606e0de27c5c64e364c5d016fba1bd5dfc8a7236
SHA512

783080f7f4bd642c2c053b3e1eca1870dc46a4e3742b9ef24de12d128ec34680749719dec33353f964cd79e6c0fd750a6471722b1a3c9afe89663788d002388b
SSDEEP

12288:uP1N1ouo5xthlk6nLXRnqm12d/eO7PB7vApFU3utrM0f4+ZqsaEeY0:jxjlPp1ySFxVf4+n+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	5032	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 5032	4972	rundll32.exe	79
PID 4972 wrote to memory of 5032	4972	rundll32.exe	79
PID 4972 wrote to memory of 5032	4972	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\ffmpeg.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\ffmpeg.dll",#1
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 612
    3⤵
    - Program crash
    PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5032 -ip 5032
1⤵
PID:4776