d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:51

Target

MediaCoder/codecs/drv43260.dll
Size

212KB
MD5

711dbc8f0a5d89a2c946c33f2d717c75
SHA1

3a6f86ebdc030275300fb822ada7d46f8b7f50fc
SHA256

74a4f8dbc4c9b7202b4e9f65d7988b7e64534c538a5783352ce0c3c7bba54cca
SHA512

d4841e57c078104f7d1393bd7813775e14a33ed0dfd95fde34ba321e24190a1d0e028cee7d4cea87b46fa330b1bf3f27200cd4424dfac78e0181e8c6a613f495
SSDEEP

3072:9K9Nf2DMe6qwnqZvOFGG8uRjmx1L/jF8ybsejQlnblsMljB2z3dFO:qNfBe6quil2Ase4bljEz/O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
3016	2276	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2276	3020	rundll32.exe	17
PID 3020 wrote to memory of 2276	3020	rundll32.exe	17
PID 3020 wrote to memory of 2276	3020	rundll32.exe	17
PID 3020 wrote to memory of 2276	3020	rundll32.exe	17
PID 3020 wrote to memory of 2276	3020	rundll32.exe	17
PID 3020 wrote to memory of 2276	3020	rundll32.exe	17
PID 3020 wrote to memory of 2276	3020	rundll32.exe	17
PID 2276 wrote to memory of 3016	2276	rundll32.exe	16
PID 2276 wrote to memory of 3016	2276	rundll32.exe	16
PID 2276 wrote to memory of 3016	2276	rundll32.exe	16
PID 2276 wrote to memory of 3016	2276	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv43260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv43260.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 224
1⤵
- Program crash
PID:3016