d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/drv23260.dll
Size

172KB
MD5

2bf29d229c9f685031945e77e6babd34
SHA1

5c9143a026287aeea058a3ac8badf8d912a6cde8
SHA256

55290e91d764bc8ae3a546f9a37bd2cbc09d7fb84abea2cbc10e8bb67448f3fc
SHA512

5691081b14e6961d95a811437c8c3dd7a530d239aa64c358228a0f8b45e6336addc4b52af523800c04582bf21f5735ca58f4d6463205ed5ec33c7e0f30364bf6
SSDEEP

3072:ojOea1/ldZlkkY94iFG11y1rgzep5oR4DDDDDDDkuH:3dZlI+iFG11y1rgzejdDDDDDDDk4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3300	4600	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4600	4812	rundll32.exe	89
PID 4812 wrote to memory of 4600	4812	rundll32.exe	89
PID 4812 wrote to memory of 4600	4812	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv23260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv23260.dll,#1
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 620
    3⤵
    - Program crash
    PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4600 -ip 4600
1⤵
PID:3632