d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/drv13260.dll
Size

100KB
MD5

738841fd8c4c708bcb79a5a2b734713c
SHA1

9fe1a1821c326e2546deda0b21d3f8e2f20faa98
SHA256

93d1bdc988067375fb3fe203d9688429dd7399cb69d17ef3b314b21dcfb07ccd
SHA512

0d55f2f0e57b2a458828e0def52da895916cf5dc2d865418b254a4d7df00ce0c96aa0738db2f056ca5f56984a4d8808da5e48dd91390de627b681d651662ff8e
SSDEEP

1536:N5reeEcdd9INF7s+NYVRh15TTVVuRh15TTVVIZiuATGMV+D8sX7RV0QTstcc7Xsc:naVyI3LNsZuh8VTEcc7cc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5116	1660	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1660	2228	rundll32.exe	14
PID 2228 wrote to memory of 1660	2228	rundll32.exe	14
PID 2228 wrote to memory of 1660	2228	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv13260.dll,#1
1⤵
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 616
  2⤵
  - Program crash
  PID:5116

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv13260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1660 -ip 1660
1⤵
PID:3204