66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2

Analysis

max time kernel
1809s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Target

media_dll/swscale-2.dll
Size

341KB
MD5

7fa03cb3afa27f54fa590565a3d44d89
SHA1

09c2e39cd03e5aba2ceb35dee8e6be3d9e2d7be1
SHA256

6df044cddd4ea93286c2cae52843df0d93f6019c589fc68b9fe358a1c0b37cd4
SHA512

bf207207af21d74eea6be2f9eeee29082418010aae8f4dab3f3f4ab252ee717b3f76dbecedbf9d0216b5d9073e30589fd5b2b4efb0471b4963f04d55f4c46b75
SSDEEP

6144:p6UJUxtKVPoPwT6tQfrRupxA8NFd8KrW4Qb4LwwaorjILW8hXwt3umDfkXvPvzuo:BVQOKrW4QbzorjILWESZHA+jE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	1616	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1616	4524	rundll32.exe	88
PID 4524 wrote to memory of 1616	4524	rundll32.exe	88
PID 4524 wrote to memory of 1616	4524	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\swscale-2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\media_dll\swscale-2.dll,#1
  2⤵
  PID:1616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 616
    3⤵
    - Program crash
    PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1616 -ip 1616
1⤵
PID:1976

memory/1616-0-0x000000006AB00000-0x000000006AB5B000-memory.dmp

Filesize
364KB

Download
memory/1616-1-0x0000000066D80000-0x0000000066DC1000-memory.dmp

Filesize
260KB

Download