66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2

Analysis

max time kernel
1734s
max time network
1169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Target

media_dll/avcodec-54.dll
Size

12.2MB
MD5

e963ace19f4e9e868fe66d0e96acdc22
SHA1

60fd015a55bba81f2896b743653a066bee38141d
SHA256

d90642b385253746463ae057efaa15cde2b48c417d41b328b818967e0c136aaf
SHA512

a6feae0f48daccbdbfdcefe2b3608dbf5e981c90e149a1721225721de97efd73fe53e70f7e7200e1d817cd892f088f5a1a733e576355db2975aced1d34ea4c22
SSDEEP

196608:z2xjq006ToWrVMSE2Yv+nkCtagj+GslOTOFfyshz1x8HsX3YX45G49/PQCpPe/j4:RqCvHCcQCpWSB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3168	1048	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 1048	416	rundll32.exe	89
PID 416 wrote to memory of 1048	416	rundll32.exe	89
PID 416 wrote to memory of 1048	416	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\avcodec-54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\avcodec-54.dll,#1
  2⤵
  PID:1048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 616
    3⤵
    - Program crash
    PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1048 -ip 1048
1⤵
PID:1544

memory/1048-0-0x000000006A0C0000-0x000000006B397000-memory.dmp

Filesize
18.8MB

Download
memory/1048-2-0x0000000066D80000-0x0000000066DC1000-memory.dmp

Filesize
260KB

Download