ca9fa20f5cecf6a9988527835dc9cae2f03efa22b0e3a19f844161d709acfc63

Analysis

max time kernel
129s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 13:14

Target

C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/Serum.aaxplugin/Contents/x64/Serum.dll
Size

4.9MB
MD5

b643cee3d0e3d65325fe56e1b55c79e5
SHA1

235d8d359e4cdad24c118f27c9d947b69274c3e7
SHA256

e529c6fdb80d689f931189855c5cd1a099c5d5cd42473fe2fbfc9fdfa5f077c1
SHA512

43f9437e654f9805dffb57a277b9f2c6ec93b4d9f03da957adbd2e86103823c39f37dbc1a3d8c55b946530cde47d08b3b78b91b8aeb57d74dafee1640883e5af
SSDEEP

98304:GklwfWBijJc1IIkeddKJqh3S7ts7ftUmz1EtfJ2:/wfWBijJc1IIkeddKJqhCZIftEc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5912	1100	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 1100	4148	rundll32.exe	89
PID 4148 wrote to memory of 1100	4148	rundll32.exe	89
PID 4148 wrote to memory of 1100	4148	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.dll",#1
  2⤵
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 684
    3⤵
    - Program crash
    PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1100 -ip 1100
1⤵
PID:4360