c29e6275fc256e1429d770754e9018c609693e7eb41d3d2e68e70dc19c436903

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 00:42

Target

mplayer/codecs/sipr.dll
Size

164KB
MD5

413acd92b9c8e972c088e8ba5366ae36
SHA1

4d6b6d6ff0f5dbf9d4c7bd6051e3fe10ee5423ac
SHA256

8808d5cd9656cfa0204c533520edf04ae4e9c05011c581c2d1d91098191a37e7
SHA512

7a6448cb2e0470485e27e1e3dd8513c8143b4ca095495b0ade6136a295d4831b8071d20dfe2593ca211792179d0685da315f1af83858c2fd87db114b6240ed76
SSDEEP

3072:76wUsW8HZMNtlBuyZOXDiMRNpHy50SVk4tk6djM7K8+YVV6CI7ZWTELI7ZWTwja:7nJfqXnNZOJ3ok6d4K8XMFWTJFWTB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2228	2116	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2116	3712	rundll32.exe	89
PID 3712 wrote to memory of 2116	3712	rundll32.exe	89
PID 3712 wrote to memory of 2116	3712	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mplayer\codecs\sipr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mplayer\codecs\sipr.dll,#1
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 608
    3⤵
    - Program crash
    PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2116 -ip 2116
1⤵
PID:2296

memory/2116-0-0x0000000061C60000-0x0000000061C89000-memory.dmp

Filesize
164KB

Download
memory/2116-1-0x0000000061C60000-0x0000000061C89000-memory.dmp

Filesize
164KB

Download