c29e6275fc256e1429d770754e9018c609693e7eb41d3d2e68e70dc19c436903

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 00:42

Target

mplayer/codecs/raac.dll
Size

544KB
MD5

9409a83cadf574cb63d00b96a31639ff
SHA1

52f3ba611f6fd1828a1335f7eb4b4353a6d08e2e
SHA256

195c2c33a088e1fa9fe8559f8e16a8b621cdd2f886caad4f90c205947a896327
SHA512

98c8e6f3cac7d6b7ed6861dd07d634d500e61f239f1da35d78e88db71995b28b38099c3e0e96afb64f549cc620d24c5358f7cd46bb346e903fed83332f0c5b7a
SSDEEP

12288:ZAgSCbWhwUy1UUtAfFRHwJE7NGD5ysM7cjBUBgTa0qNcKKKKYYYYYB9fz0ZZdxi5:ZAmWhwnUUSFRHkE7NGMsM7cjBGg4NcKz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1872	2288	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2288	2148	rundll32.exe	28
PID 2148 wrote to memory of 2288	2148	rundll32.exe	28
PID 2148 wrote to memory of 2288	2148	rundll32.exe	28
PID 2148 wrote to memory of 2288	2148	rundll32.exe	28
PID 2148 wrote to memory of 2288	2148	rundll32.exe	28
PID 2148 wrote to memory of 2288	2148	rundll32.exe	28
PID 2148 wrote to memory of 2288	2148	rundll32.exe	28
PID 2288 wrote to memory of 1872	2288	rundll32.exe	29
PID 2288 wrote to memory of 1872	2288	rundll32.exe	29
PID 2288 wrote to memory of 1872	2288	rundll32.exe	29
PID 2288 wrote to memory of 1872	2288	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mplayer\codecs\raac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mplayer\codecs\raac.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 228
    3⤵
    - Program crash
    PID:1872