d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
146s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/atrc3260.dll
Size

72KB
MD5

72d780ef3578ce8431cff86bcc9496f6
SHA1

1b99ac1b62899a4f5830d9bbd786b317aaf6289e
SHA256

8c360d8c39006b6a011dbf3a0313e818eeb53990556659c5a1b7e478048e7fbb
SHA512

a17bb64a508f4952aa1ecdd27850ba2460b3c1b8dedf0e11aa3707be025512930b8ef5778e88387230c35ad4840442944b7f9eef43e6065ae3b549959b4c7377
SSDEEP

768:t0H24Njupst+NRxt7c2fJcfCd6jP+NAO0IpBQbYwdq2bdIYTZaon+sQYYemE:qH/u5xt7vq1jGNFvHwp98XsQheB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	3444	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3444	4696	rundll32.exe	91
PID 4696 wrote to memory of 3444	4696	rundll32.exe	91
PID 4696 wrote to memory of 3444	4696	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\atrc3260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\atrc3260.dll,#1
  2⤵
  PID:3444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 620
    3⤵
    - Program crash
    PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3444 -ip 3444
1⤵
PID:4204