d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/ct-libisomedia.dll
Size

280KB
MD5

39e38e5c566ba9537082f85ae00b1f36
SHA1

19be289ee455ff61625e258ebe0fa56987b5d15b
SHA256

2eda1fadce9bfec9b09c38d8a7b7c4a04b9aff243f55771e41f59f127e4cba7b
SHA512

26560ae55b41ac53d16bdecc17d01d931fae3a5e5981d5ec2b972c2a17ec2d1dd599c59394bdfb202d92b4e125b07de73fd48e28fa678378c3915421e324725b
SSDEEP

3072:Lh6/zTw9YFu/crXc8XvYtEyYU8urIg1fD//dJYaBABxprZ4jxocyPd3Zb:LMwMcKvYOyx8usg1f7XtSbp14jsd3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2224	1944	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1944	2400	rundll32.exe	15
PID 2400 wrote to memory of 1944	2400	rundll32.exe	15
PID 2400 wrote to memory of 1944	2400	rundll32.exe	15
PID 2400 wrote to memory of 1944	2400	rundll32.exe	15
PID 2400 wrote to memory of 1944	2400	rundll32.exe	15
PID 2400 wrote to memory of 1944	2400	rundll32.exe	15
PID 2400 wrote to memory of 1944	2400	rundll32.exe	15
PID 1944 wrote to memory of 2224	1944	rundll32.exe	14
PID 1944 wrote to memory of 2224	1944	rundll32.exe	14
PID 1944 wrote to memory of 2224	1944	rundll32.exe	14
PID 1944 wrote to memory of 2224	1944	rundll32.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 224
1⤵
- Program crash
PID:2224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\ct-libisomedia.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\ct-libisomedia.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400