d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:51

Target

MediaCoder/codecs/aacPlusEnc.dll
Size

384KB
MD5

486391e54a00e26d5b63969bb890f27a
SHA1

fdd3b580f50478dc75643d5527b7aa4c4afec0fb
SHA256

47041073000c306aaff37bce89638259f60369a800df42460b0572ec9c545084
SHA512

d1feb70355b662c0b4e438193d980927bc49ea73e7c29b963b1c1baa6099efeb05560f7f5e125a7272a97e9cfeb66a44f2f58185237ad3a36f7539a752e0c4d6
SSDEEP

6144:H46ofueoqQFUSg3AM03SnO7PwMq/NODWT1D0N6CbFSIAOUzQ74:ROueoqQLsAMjIPwMq/NODeZ0N6CbFlyE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	944	WerFault.exe	16

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 944	2244	rundll32.exe	16
PID 2244 wrote to memory of 944	2244	rundll32.exe	16
PID 2244 wrote to memory of 944	2244	rundll32.exe	16
PID 2244 wrote to memory of 944	2244	rundll32.exe	16
PID 2244 wrote to memory of 944	2244	rundll32.exe	16
PID 2244 wrote to memory of 944	2244	rundll32.exe	16
PID 2244 wrote to memory of 944	2244	rundll32.exe	16
PID 944 wrote to memory of 1524	944	rundll32.exe	17
PID 944 wrote to memory of 1524	944	rundll32.exe	17
PID 944 wrote to memory of 1524	944	rundll32.exe	17
PID 944 wrote to memory of 1524	944	rundll32.exe	17

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\aacPlusEnc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 232
  2⤵
  - Program crash
  PID:1524

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\aacPlusEnc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244

memory/944-0-0x00000000001B0000-0x00000000001F7000-memory.dmp

Filesize
284KB

Download