66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2

Analysis

max time kernel
1672s
max time network
1168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Target

media_dll/avformat-54.dll
Size

2.9MB
MD5

e126e1992b3ddd762e94072c44cbeb19
SHA1

685de62959c08f5f6883dfef09356eebec7a641f
SHA256

ad255c3a737af798227530b19831790f7e0f1d31c027aa41c2ccb2bcdeb2c41e
SHA512

a11c4fba9ffc3b1776069949b45ccc3748a8472e3ade76ce3fdc950a6d86915609431c989ba18676a0f8fb6f1fd591b9fc1a154e85a561c66179d5a3f744c51b
SSDEEP

49152:UMfTQja0z9T1wL10bmEpfmcqyfOb0ofMHU8AZFAPnro2FOa9aJyey9DWu8p9rgnA:UMrQja0z9T1jpupyfOTfMHU8AZF6nrot

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3480	1872	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1872	4472	rundll32.exe	88
PID 4472 wrote to memory of 1872	4472	rundll32.exe	88
PID 4472 wrote to memory of 1872	4472	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\avformat-54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\avformat-54.dll,#1
  2⤵
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 680
    3⤵
    - Program crash
    PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1872 -ip 1872
1⤵
PID:5096

memory/1872-0-0x000000006A0C0000-0x000000006B397000-memory.dmp

Filesize
18.8MB

Download
memory/1872-1-0x0000000069900000-0x0000000069BEB000-memory.dmp

Filesize
2.9MB

Download
memory/1872-3-0x0000000066D80000-0x0000000066DC1000-memory.dmp

Filesize
260KB

Download