d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/drv23260.dll
Size

172KB
MD5

2bf29d229c9f685031945e77e6babd34
SHA1

5c9143a026287aeea058a3ac8badf8d912a6cde8
SHA256

55290e91d764bc8ae3a546f9a37bd2cbc09d7fb84abea2cbc10e8bb67448f3fc
SHA512

5691081b14e6961d95a811437c8c3dd7a530d239aa64c358228a0f8b45e6336addc4b52af523800c04582bf21f5735ca58f4d6463205ed5ec33c7e0f30364bf6
SSDEEP

3072:ojOea1/ldZlkkY94iFG11y1rgzep5oR4DDDDDDDkuH:3dZlI+iFG11y1rgzejdDDDDDDDk4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	1988	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1988	1040	rundll32.exe	28
PID 1040 wrote to memory of 1988	1040	rundll32.exe	28
PID 1040 wrote to memory of 1988	1040	rundll32.exe	28
PID 1040 wrote to memory of 1988	1040	rundll32.exe	28
PID 1040 wrote to memory of 1988	1040	rundll32.exe	28
PID 1040 wrote to memory of 1988	1040	rundll32.exe	28
PID 1040 wrote to memory of 1988	1040	rundll32.exe	28
PID 1988 wrote to memory of 2172	1988	rundll32.exe	29
PID 1988 wrote to memory of 2172	1988	rundll32.exe	29
PID 1988 wrote to memory of 2172	1988	rundll32.exe	29
PID 1988 wrote to memory of 2172	1988	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv23260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv23260.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 228
    3⤵
    - Program crash
    PID:2172