d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/drv33260.dll
Size

204KB
MD5

fffaaef7265285a274c3535b65238693
SHA1

48a09c0783e11d1a7652f750d2112f883f0d863a
SHA256

ee90c721a19f24fc565cc86b4894c637e14a6d909b77b45cf50220651d32dad1
SHA512

fab4427d41d64745e251478840e33c7db369fe1a471c374aa7e22336d90305e2933f872b8a190b1f75f574dabbb98156d81932cc6d2777e15bb84a0713b80c8d
SSDEEP

3072:yYOx9xNKeWKqoV4yEQs9BsIWoVXeKiwP1Rh5WljB2z3AlZ:Kx9xNKeW4lSBRWoVXeKdbWljEze

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
292	2324	WerFault.exe	16

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2324	3068	rundll32.exe	16
PID 3068 wrote to memory of 2324	3068	rundll32.exe	16
PID 3068 wrote to memory of 2324	3068	rundll32.exe	16
PID 3068 wrote to memory of 2324	3068	rundll32.exe	16
PID 3068 wrote to memory of 2324	3068	rundll32.exe	16
PID 3068 wrote to memory of 2324	3068	rundll32.exe	16
PID 3068 wrote to memory of 2324	3068	rundll32.exe	16
PID 2324 wrote to memory of 292	2324	rundll32.exe	17
PID 2324 wrote to memory of 292	2324	rundll32.exe	17
PID 2324 wrote to memory of 292	2324	rundll32.exe	17
PID 2324 wrote to memory of 292	2324	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv33260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv33260.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 224
    3⤵
    - Program crash
    PID:292