c5f1dfbf8d4b1d8d5c43f668292056d5b670fea174e6e79d3cc2ba341d66a21f

Analysis

max time kernel
27s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 03:32

Target

data/so4mediainfolib.dll
Size

5.1MB
MD5

cc6ca4ee5957177f2a69373b8854afac
SHA1

cf7042eb99b7b18ec2ac3c290f0d560506489383
SHA256

09db2bf8388e846efedeef1ca35bd153099ea8a71ab6b2f3432b0860e92acc76
SHA512

4d7f6ae74774275505f637b0dffde7e854b2d9d068b7ce2bf1e4a51836fef878f7ae6ff3b1854a6241ca95acaa853d4c072bfce9e0f0a9b230f1974442a067fb
SSDEEP

49152:00rQA/IyqNhMTTvenzSOrMuwf7eYZbPaqz5g1rLLnHP1PQwk1UEFDoKwG0/l2B8s:SMTTNxmrLcSI4ky/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	1204	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1860	1204	rundll32.exe	27
PID 1204 wrote to memory of 1860	1204	rundll32.exe	27
PID 1204 wrote to memory of 1860	1204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\so4mediainfolib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1204 -s 84
  2⤵
  - Program crash
  PID:1860