12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
361s
max time network
375s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Target

Common Files/AVPlay.dll
Size

72KB
MD5

4e35592f3544734bfe14989a45c6eda7
SHA1

c8b16170c6baeaea34162b6b49bfdca682ed8f4a
SHA256

44ff56566e390848c41f83e7340777282c6a641aec7934fbc8947e55bab03c20
SHA512

8742199b59cb363f5eeb911be6b4ad091377a27d0f934b274b51351e2b959cd0c4a89c0e109a3be4fdc88a0588fec2192d8b454593233b4bbe8fb2696fafd99e
SSDEEP

768:FzWPIyYs5H3y9ZX+XLuUa1RXerLnOoW1NkDYzqsSmwZduLz:F6xYZ9ZXguUFFW1eYzqsBEduLz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	2184	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2184	1948	rundll32.exe	28
PID 1948 wrote to memory of 2184	1948	rundll32.exe	28
PID 1948 wrote to memory of 2184	1948	rundll32.exe	28
PID 1948 wrote to memory of 2184	1948	rundll32.exe	28
PID 1948 wrote to memory of 2184	1948	rundll32.exe	28
PID 1948 wrote to memory of 2184	1948	rundll32.exe	28
PID 1948 wrote to memory of 2184	1948	rundll32.exe	28
PID 2184 wrote to memory of 2212	2184	rundll32.exe	29
PID 2184 wrote to memory of 2212	2184	rundll32.exe	29
PID 2184 wrote to memory of 2212	2184	rundll32.exe	29
PID 2184 wrote to memory of 2212	2184	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\AVPlay.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\AVPlay.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 240
    3⤵
    - Program crash
    PID:2212

memory/2184-54-0x00000000000F0000-0x0000000000109000-memory.dmp

Filesize
100KB

Download