ca9fa20f5cecf6a9988527835dc9cae2f03efa22b0e3a19f844161d709acfc63

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 13:14

Target

C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/Contents/Win32/Serum.dll
Size

4.2MB
MD5

94d1f67c5dcbd5d8069934908f410a6b
SHA1

e1f06989f1635f527b3f4ff1f2ee3b38f237aeee
SHA256

0ffe6dd9a17dd5c26dace950f809537eb392590491a9782fc9c9f53568616b6f
SHA512

75dc65ffa211e2cecc02ca90d4f72a217f4ae360ac50b706e0c5558c4d7e9c783401bf72a9523f4edbbfa65fd1839a1afcba76cdd93d61fee40292f8c3c16eaa
SSDEEP

98304:qOB2NjskrEjIzWRZ9sWALoTE9zsX5IULKbo9JOv:qOZ2EoWRZ9szoE9zsX5IULKVv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1852	1844	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1844	1676	rundll32.exe	28
PID 1676 wrote to memory of 1844	1676	rundll32.exe	28
PID 1676 wrote to memory of 1844	1676	rundll32.exe	28
PID 1676 wrote to memory of 1844	1676	rundll32.exe	28
PID 1676 wrote to memory of 1844	1676	rundll32.exe	28
PID 1676 wrote to memory of 1844	1676	rundll32.exe	28
PID 1676 wrote to memory of 1844	1676	rundll32.exe	28
PID 1844 wrote to memory of 1852	1844	rundll32.exe	29
PID 1844 wrote to memory of 1852	1844	rundll32.exe	29
PID 1844 wrote to memory of 1852	1844	rundll32.exe	29
PID 1844 wrote to memory of 1852	1844	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 284
    3⤵
    - Program crash
    PID:1852