fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 04:08

Target
Data/avutil-56.dll
Size 1012KB
Sample240605-eql18sdg3z
SHA256 b5403471304237e2486a1d5934149ea493eac3859d9d423d5630226dfb10fb44
MD5 6d4099c60bf587da444fb3c8d639c6a1
SHA1 5522a4d16342ac33c30a8f3b753eb174cae30bfe
SHA512 37122057cc98e55e88337b54735aa217361b12cefc899340a46626792403b34ab71af763e0d395c793e93f76479f7b1c36d6479a7579ab04c45ed98f50b65fbc
SSDEEP 12288:hILFD9BRz6CxSLPSmi3D1qzq1x3pFEIXH6bCHHtMPv1kt96fGKBsRtXIix42N:SFTRDxSLPSmi60pFEIXN7tYfGXW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	2264	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2264	1824	rundll32.exe	28
PID 1824 wrote to memory of 2264	1824	rundll32.exe	28
PID 1824 wrote to memory of 2264	1824	rundll32.exe	28
PID 1824 wrote to memory of 2264	1824	rundll32.exe	28
PID 1824 wrote to memory of 2264	1824	rundll32.exe	28
PID 1824 wrote to memory of 2264	1824	rundll32.exe	28
PID 1824 wrote to memory of 2264	1824	rundll32.exe	28
PID 2264 wrote to memory of 2412	2264	rundll32.exe	29
PID 2264 wrote to memory of 2412	2264	rundll32.exe	29
PID 2264 wrote to memory of 2412	2264	rundll32.exe	29
PID 2264 wrote to memory of 2412	2264	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avutil-56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\avutil-56.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 240
    3⤵
    - Program crash
    PID:2412

memory/2264-0-0x0000000074480000-0x0000000074794000-memory.dmp

Download