67c7cffe7c07e21d7ca8100d81778a8e0ea073a6e947a6781687f498ae740648

Analysis

max time kernel
143s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

r128gain-0.9.7-2/r128gain-tools/avcodec-54.dll
Size

2.8MB
MD5

1fa7fe1bc82c393d6c753b87908b951f
SHA1

394e224b2a77759603145398216bfff4f72dff55
SHA256

46c74eb8845547313f6cd08bd7714dcf68a517c9607a32d203a6f99f3253e770
SHA512

84968fec0853b2d54f5df4cb6b56ebab736be9b36a431ada46784ac0510660f6f01ba93af906610d6d97e151e2c61178ba53243d9af5aed73336f44fede4034a
SSDEEP

49152:+9ElWfImrFUyDEME/dPO9/y4DoGaCWOXeq4pzlZoVPRzfMnEGwrc:+9I8ImRU7MqdPO9/y4DoGaCNXeq4bZo9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2740	2580	WerFault.exe	17

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2580	1200	rundll32.exe	17
PID 1200 wrote to memory of 2580	1200	rundll32.exe	17
PID 1200 wrote to memory of 2580	1200	rundll32.exe	17
PID 1200 wrote to memory of 2580	1200	rundll32.exe	17
PID 1200 wrote to memory of 2580	1200	rundll32.exe	17
PID 1200 wrote to memory of 2580	1200	rundll32.exe	17
PID 1200 wrote to memory of 2580	1200	rundll32.exe	17
PID 2580 wrote to memory of 2740	2580	rundll32.exe	21
PID 2580 wrote to memory of 2740	2580	rundll32.exe	21
PID 2580 wrote to memory of 2740	2580	rundll32.exe	21
PID 2580 wrote to memory of 2740	2580	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\avcodec-54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\avcodec-54.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 228
    3⤵
    - Program crash
    PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2580-1-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-3-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-2-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-6-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-10-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-12-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-15-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-16-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-19-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-20-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-23-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-24-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-25-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-26-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-28-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-31-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-34-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-35-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-36-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-37-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-40-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-41-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-42-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-44-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-45-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-48-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-49-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-51-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-52-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-54-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-56-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-57-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-59-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-60-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-61-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-58-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-50-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-47-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-43-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-38-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-33-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-30-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-22-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-18-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-14-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-8-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-5-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-0-0x000000006A0C0000-0x000000006A569000-memory.dmp

Filesize
4.7MB

Download
memory/2580-63-0x0000000068B80000-0x0000000068BAC000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads