d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
260s
max time network
317s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:51

Target

MediaCoder/codecs/cook3260.dll
Size

64KB
MD5

127816f8ac3233e41ab10eb0e1bc67a4
SHA1

56ea32a6bfc02336c23e88677d70d707277d569c
SHA256

816b4e3cb79ec61617c4b060f40f86b44871c74845dc6ac465fc3dbcf1dbdbea
SHA512

259ec9426d57e7436cdb8dc34d999ed02ea44c305348d1c1e847da124d74800edd39f620adcb344aed26e1845fe1e26370047c48dac852c48cf4e312ad1e3876
SSDEEP

768:RcM/aeHo1R7WvmTb7VQcDPMSFFYr3XN+lyVEonS91C5kstNf3Ghv+Xbp4s:qW8RNHBQcRFo3XN+kSt1kv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1616	2548	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2548	2748	rundll32.exe	27
PID 2748 wrote to memory of 2548	2748	rundll32.exe	27
PID 2748 wrote to memory of 2548	2748	rundll32.exe	27
PID 2748 wrote to memory of 2548	2748	rundll32.exe	27
PID 2748 wrote to memory of 2548	2748	rundll32.exe	27
PID 2748 wrote to memory of 2548	2748	rundll32.exe	27
PID 2748 wrote to memory of 2548	2748	rundll32.exe	27
PID 2548 wrote to memory of 1616	2548	rundll32.exe	28
PID 2548 wrote to memory of 1616	2548	rundll32.exe	28
PID 2548 wrote to memory of 1616	2548	rundll32.exe	28
PID 2548 wrote to memory of 1616	2548	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\cook3260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\cook3260.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 228
    3⤵
    - Program crash
    PID:1616