d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
148s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/cook3260.dll
Size

64KB
MD5

127816f8ac3233e41ab10eb0e1bc67a4
SHA1

56ea32a6bfc02336c23e88677d70d707277d569c
SHA256

816b4e3cb79ec61617c4b060f40f86b44871c74845dc6ac465fc3dbcf1dbdbea
SHA512

259ec9426d57e7436cdb8dc34d999ed02ea44c305348d1c1e847da124d74800edd39f620adcb344aed26e1845fe1e26370047c48dac852c48cf4e312ad1e3876
SSDEEP

768:RcM/aeHo1R7WvmTb7VQcDPMSFFYr3XN+lyVEonS91C5kstNf3Ghv+Xbp4s:qW8RNHBQcRFo3XN+kSt1kv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	3180	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3180	3176	rundll32.exe	87
PID 3176 wrote to memory of 3180	3176	rundll32.exe	87
PID 3176 wrote to memory of 3180	3176	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\cook3260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\cook3260.dll,#1
  2⤵
  PID:3180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 608
    3⤵
    - Program crash
    PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3180 -ip 3180
1⤵
PID:3644