d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/ct-libisomedia.dll
Size

280KB
MD5

39e38e5c566ba9537082f85ae00b1f36
SHA1

19be289ee455ff61625e258ebe0fa56987b5d15b
SHA256

2eda1fadce9bfec9b09c38d8a7b7c4a04b9aff243f55771e41f59f127e4cba7b
SHA512

26560ae55b41ac53d16bdecc17d01d931fae3a5e5981d5ec2b972c2a17ec2d1dd599c59394bdfb202d92b4e125b07de73fd48e28fa678378c3915421e324725b
SSDEEP

3072:Lh6/zTw9YFu/crXc8XvYtEyYU8urIg1fD//dJYaBABxprZ4jxocyPd3Zb:LMwMcKvYOyx8usg1f7XtSbp14jsd3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	1932	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1932	1640	rundll32.exe	15
PID 1640 wrote to memory of 1932	1640	rundll32.exe	15
PID 1640 wrote to memory of 1932	1640	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\ct-libisomedia.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\ct-libisomedia.dll,#1
  2⤵
  PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 600
    3⤵
    - Program crash
    PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1932 -ip 1932
1⤵
PID:5072