ca9fa20f5cecf6a9988527835dc9cae2f03efa22b0e3a19f844161d709acfc63

Analysis

max time kernel
120s
max time network
159s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 13:14

Target

C:/Program Files/Common Files/Avid/Audio/Plug-Ins/-Serum.aaxplugin/Contents/Win32/Serum.dll
Size

4.2MB
MD5

f5a14d8cdf2bf4f70c83db87b64e6fdd
SHA1

8b312fa3d71756c34e270be40c7e8e4ab66f531e
SHA256

4fb16e8a2d30a89aee1f80c73ae207e9d101986249baddec5b5e81451d3d55bc
SHA512

4d663dd8f853bd6ab6e5764ee8f65dc33f7d15ed7b99256e49709a5e00517f99c0c85d1b37ffee7ce11005aeb13f9fc7e9a48a0dc8c3aff7ac747af7385ceaf3
SSDEEP

98304:qD1yzwb/aCtdnld7/RJTqQp7ouEv23khOoStZPDVG:qD13F/HJTqIlEv23khOoStZRG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	2760	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2760	2872	rundll32.exe	30
PID 2872 wrote to memory of 2760	2872	rundll32.exe	30
PID 2872 wrote to memory of 2760	2872	rundll32.exe	30
PID 2872 wrote to memory of 2760	2872	rundll32.exe	30
PID 2872 wrote to memory of 2760	2872	rundll32.exe	30
PID 2872 wrote to memory of 2760	2872	rundll32.exe	30
PID 2872 wrote to memory of 2760	2872	rundll32.exe	30
PID 2760 wrote to memory of 2464	2760	rundll32.exe	31
PID 2760 wrote to memory of 2464	2760	rundll32.exe	31
PID 2760 wrote to memory of 2464	2760	rundll32.exe	31
PID 2760 wrote to memory of 2464	2760	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Program Files\Common Files\Avid\Audio\Plug-Ins\-Serum.aaxplugin\Contents\Win32\Serum.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\Avid\Audio\Plug-Ins\-Serum.aaxplugin\Contents\Win32\Serum.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 292
    3⤵
    - Program crash
    PID:2464