d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
144s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 01:51

Target

MediaCoder/codecs/DiracEncoder.dll
Size

368KB
MD5

6944f2a2c2580e17c7382900853aa5fe
SHA1

9028b32b26dfe9858f9071ffddba9a907135843f
SHA256

9eeb2619b858024728e73279d45b7014cfd23955928a496927e2e3506ca913a4
SHA512

ebafad4256ba0acb3a89bd86e4ad2032f7ae343aeb835b02c0240af33c2247f19bcccfe4cf81b4bee80056204c738aab2177a22a3fec60bccdc5d5c5ca86f191
SSDEEP

6144:zxD/qvg/NWKstqZFqAo543qgl9yWEril1o8OTAyufajFXCS+Mb7v5pn5bXRYWsti:zxDCvC4ztqXIW3qgl9yWEribo8uAyufw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2040	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2040	4068	rundll32.exe	15
PID 4068 wrote to memory of 2040	4068	rundll32.exe	15
PID 4068 wrote to memory of 2040	4068	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\DiracEncoder.dll,#1
1⤵
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 600
  2⤵
  - Program crash
  PID:2952

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\DiracEncoder.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2040 -ip 2040
1⤵
PID:3088