ca9fa20f5cecf6a9988527835dc9cae2f03efa22b0e3a19f844161d709acfc63

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 13:14

Target

C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/-Serum.aaxplugin/Contents/Win32/Serum.dll
Size

4.2MB
MD5

f5a14d8cdf2bf4f70c83db87b64e6fdd
SHA1

8b312fa3d71756c34e270be40c7e8e4ab66f531e
SHA256

4fb16e8a2d30a89aee1f80c73ae207e9d101986249baddec5b5e81451d3d55bc
SHA512

4d663dd8f853bd6ab6e5764ee8f65dc33f7d15ed7b99256e49709a5e00517f99c0c85d1b37ffee7ce11005aeb13f9fc7e9a48a0dc8c3aff7ac747af7385ceaf3
SSDEEP

98304:qD1yzwb/aCtdnld7/RJTqQp7ouEv23khOoStZPDVG:qD13F/HJTqIlEv23khOoStZRG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4156	1540	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1540	2632	rundll32.exe	86
PID 2632 wrote to memory of 1540	2632	rundll32.exe	86
PID 2632 wrote to memory of 1540	2632	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\-Serum.aaxplugin\Contents\Win32\Serum.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\-Serum.aaxplugin\Contents\Win32\Serum.dll",#1
  2⤵
  PID:1540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 684
    3⤵
    - Program crash
    PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1540 -ip 1540
1⤵
PID:4872