d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
152s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/drv43260.dll
Size

212KB
MD5

711dbc8f0a5d89a2c946c33f2d717c75
SHA1

3a6f86ebdc030275300fb822ada7d46f8b7f50fc
SHA256

74a4f8dbc4c9b7202b4e9f65d7988b7e64534c538a5783352ce0c3c7bba54cca
SHA512

d4841e57c078104f7d1393bd7813775e14a33ed0dfd95fde34ba321e24190a1d0e028cee7d4cea87b46fa330b1bf3f27200cd4424dfac78e0181e8c6a613f495
SSDEEP

3072:9K9Nf2DMe6qwnqZvOFGG8uRjmx1L/jF8ybsejQlnblsMljB2z3dFO:qNfBe6quil2Ase4bljEz/O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	3336	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3336	3000	rundll32.exe	90
PID 3000 wrote to memory of 3336	3000	rundll32.exe	90
PID 3000 wrote to memory of 3336	3000	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv43260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv43260.dll,#1
  2⤵
  PID:3336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 620
    3⤵
    - Program crash
    PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3336 -ip 3336
1⤵
PID:1232