f89beed6469729d774f3a6769e110beb976cb47b63c306e03d4d1f3b32916e03

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-06-2023 09:49

Target

Davinci-Resolve-Studio-18/libGLESv2.dll
Size

6.8MB
MD5

b940fc514e7363ffa2ebe6bd594924cd
SHA1

b613f70179e35636fad9fc69f9d3c8560ec76c59
SHA256

05cccea17cebe7f2c4b6cf25b6fe66ea50ad74e8d98a416e3e875f0a85903fb0
SHA512

4a0419653bea2835677951ab889555c9c38ba65791990a64945cf16161992b69d565272b1789260ed3e05de2a21b8e49b5ee5c3534b35e8e665bbe4922e3a2a9
SSDEEP

49152:d59vei/JY5TCnQZ3/nWhLl/07TlVMpDFR96PEtMHPZO926fbFbtf6sgylZy8Y2cH:GZ/WhR/o2Yr8rAjWedDBVm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1628 1264 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1628	1264	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1264 wrote to memory of 1628	1264	rundll32.exe	WerFault.exe
PID 1264 wrote to memory of 1628	1264	rundll32.exe	WerFault.exe
PID 1264 wrote to memory of 1628	1264	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Davinci-Resolve-Studio-18\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1264 -s 92
2⤵
- Program crash
PID:1628