ed5fe5eb0d0146db50d8848052a4a9177c50ea00c51471f4489f1327370133d4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 09:33

Target

Total Video Converter/dssource.dll
Size

72KB
MD5

26c170bd915455b6c78ebd3d21f561fc
SHA1

feb3f5bad20f7f0f2b712a2f2022847887d2179d
SHA256

7bac38d247c2abd354d69697901f45dcda2b7f96fc1d83abce12f7cc339d64b1
SHA512

9528a4206de467234fa46ca44ba7e4bbfea843bec7cb9cb88f6e9dc490cbf45ed019c55054a716abad0fa9872dd170745879ba6892bad156464b2989ee57b941
SSDEEP

768:JEBTJdgHPEZmEoYvsaZitNJCTTMtOL4DAmSDHWsoBSDgBn9CeiB9QuhpcRgerRob:okHPymEosCPCTTMS5oX9oWVo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	2956	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28
PID 2956 wrote to memory of 2380	2956	rundll32.exe	29
PID 2956 wrote to memory of 2380	2956	rundll32.exe	29
PID 2956 wrote to memory of 2380	2956	rundll32.exe	29
PID 2956 wrote to memory of 2380	2956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\dssource.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\dssource.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 252
    3⤵
    - Program crash
    PID:2380