ed5fe5eb0d0146db50d8848052a4a9177c50ea00c51471f4489f1327370133d4

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 09:33

Target

Total Video Converter/OptimizeGif.dll
Size

199KB
MD5

1981590c0997f1bc9459d3559bbed1ca
SHA1

58bc93015eca68ac5a1cd3272d9edd2391e88c1b
SHA256

ae4f0f2f4953be1ddb224d3232b54cfaf9a48df55714b0b934708e6aaec9e894
SHA512

fb956e976bfb3456b8ee6731885198e4ca0740230d70a018929e84a90ead2f96279c7b053aa876759a4f4f7f1f791ba97ad1d3654dd292823a2186c875c807c3
SSDEEP

3072:aZoY/ImD9LAojbrwdQQSD4IfPDwlOVpVrWXPC22roaz5YDaXhig6c17aoAKUkqS9:jYpLf/rDD4SfqXPC22roaNYD4X7Z9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2840	1624	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1624	2016	rundll32.exe	28
PID 2016 wrote to memory of 1624	2016	rundll32.exe	28
PID 2016 wrote to memory of 1624	2016	rundll32.exe	28
PID 2016 wrote to memory of 1624	2016	rundll32.exe	28
PID 2016 wrote to memory of 1624	2016	rundll32.exe	28
PID 2016 wrote to memory of 1624	2016	rundll32.exe	28
PID 2016 wrote to memory of 1624	2016	rundll32.exe	28
PID 1624 wrote to memory of 2840	1624	rundll32.exe	29
PID 1624 wrote to memory of 2840	1624	rundll32.exe	29
PID 1624 wrote to memory of 2840	1624	rundll32.exe	29
PID 1624 wrote to memory of 2840	1624	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\OptimizeGif.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\OptimizeGif.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 256
    3⤵
    - Program crash
    PID:2840

memory/1624-0-0x0000000000690000-0x00000000006C7000-memory.dmp

Filesize
220KB

Download
memory/1624-1-0x0000000000690000-0x00000000006C7000-memory.dmp

Filesize
220KB

Download