d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
153s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 01:51

Target

MediaCoder/codecs/drv33260.dll
Size

204KB
MD5

fffaaef7265285a274c3535b65238693
SHA1

48a09c0783e11d1a7652f750d2112f883f0d863a
SHA256

ee90c721a19f24fc565cc86b4894c637e14a6d909b77b45cf50220651d32dad1
SHA512

fab4427d41d64745e251478840e33c7db369fe1a471c374aa7e22336d90305e2933f872b8a190b1f75f574dabbb98156d81932cc6d2777e15bb84a0713b80c8d
SSDEEP

3072:yYOx9xNKeWKqoV4yEQs9BsIWoVXeKiwP1Rh5WljB2z3AlZ:Kx9xNKeW4lSBRWoVXeKdbWljEze

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	1732	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1732	2880	rundll32.exe	91
PID 2880 wrote to memory of 1732	2880	rundll32.exe	91
PID 2880 wrote to memory of 1732	2880	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv33260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv33260.dll,#1
  2⤵
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 620
    3⤵
    - Program crash
    PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1732 -ip 1732
1⤵
PID:388