ed5fe5eb0d0146db50d8848052a4a9177c50ea00c51471f4489f1327370133d4

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 09:33

Target

Total Video Converter/OptimizeGif.dll
Size

199KB
MD5

1981590c0997f1bc9459d3559bbed1ca
SHA1

58bc93015eca68ac5a1cd3272d9edd2391e88c1b
SHA256

ae4f0f2f4953be1ddb224d3232b54cfaf9a48df55714b0b934708e6aaec9e894
SHA512

fb956e976bfb3456b8ee6731885198e4ca0740230d70a018929e84a90ead2f96279c7b053aa876759a4f4f7f1f791ba97ad1d3654dd292823a2186c875c807c3
SSDEEP

3072:aZoY/ImD9LAojbrwdQQSD4IfPDwlOVpVrWXPC22roaz5YDaXhig6c17aoAKUkqS9:jYpLf/rDD4SfqXPC22roaNYD4X7Z9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4720	2808	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2808	1020	rundll32.exe	19
PID 1020 wrote to memory of 2808	1020	rundll32.exe	19
PID 1020 wrote to memory of 2808	1020	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\OptimizeGif.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Total Video Converter\OptimizeGif.dll",#1
  2⤵
  PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 652
    3⤵
    - Program crash
    PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 2808
1⤵
PID:1412

memory/2808-0-0x0000000002120000-0x0000000002157000-memory.dmp

Filesize
220KB

Download
memory/2808-1-0x0000000002120000-0x0000000002157000-memory.dmp

Filesize
220KB

Download