fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 04:08

Target
Data/avformat-58.dll
Size 9.2MB
Sample240605-eql18sdg3z
SHA256 8dd4d545d5ca0d4922ae10d780d5debfd98c782d498273df30663a54bd570439
MD5 4485b1ff36dde30df2003d18a4d58e72
SHA1 1fd170e1fab71b648155dd842705a2c1bf786c0f
SHA512 6cc3262faebcf8ceccd44220ceb2ae24eb3941d57ab0b1f24f03757a38d8713ab02db73298c9c17a480ff8a70317864a75ad0c4c21baeb18e4f1a849684e380e
SSDEEP 196608:taTF/Tp8Axxb2K5HaYJye1HDwL1Z6NvW9pIMs0KRA8vTjVrxk:YzxFPN1HsL1Z6vca35
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	280	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 280 wrote to memory of 2816	280	rundll32.exe	29
PID 280 wrote to memory of 2816	280	rundll32.exe	29
PID 280 wrote to memory of 2816	280	rundll32.exe	29
PID 280 wrote to memory of 2816	280	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avformat-58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avformat-58.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 280 -s 420
    3⤵
    - Program crash
    PID:2816

memory/280-0-0x00000000736F0000-0x00000000740AB000-memory.dmp

Download

memory/280-2-0x0000000074EA0000-0x00000000751B4000-memory.dmp

Download

memory/280-3-0x0000000074DF0000-0x0000000074E74000-memory.dmp

Download

memory/280-1-0x0000000070E60000-0x00000000736E9000-memory.dmp

Download