d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
140s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 01:51

Target

MediaCoder/codecs/aacPlusEnc.dll
Size

384KB
MD5

486391e54a00e26d5b63969bb890f27a
SHA1

fdd3b580f50478dc75643d5527b7aa4c4afec0fb
SHA256

47041073000c306aaff37bce89638259f60369a800df42460b0572ec9c545084
SHA512

d1feb70355b662c0b4e438193d980927bc49ea73e7c29b963b1c1baa6099efeb05560f7f5e125a7272a97e9cfeb66a44f2f58185237ad3a36f7539a752e0c4d6
SSDEEP

6144:H46ofueoqQFUSg3AM03SnO7PwMq/NODWT1D0N6CbFSIAOUzQ74:ROueoqQLsAMjIPwMq/NODeZ0N6CbFlyE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3352	5084	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 5084	3660	rundll32.exe	89
PID 3660 wrote to memory of 5084	3660	rundll32.exe	89
PID 3660 wrote to memory of 5084	3660	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\aacPlusEnc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\aacPlusEnc.dll,#1
  2⤵
  PID:5084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 640
    3⤵
    - Program crash
    PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5084 -ip 5084
1⤵
PID:3084

memory/5084-0-0x0000000002410000-0x0000000002457000-memory.dmp

Filesize
284KB

Download