72fd51a857e810cf54291ab1aceab06565cc4a4da8af3eaff1efe634d153db00

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-06-2024 07:22

Target

avutil-56.dll
Size

348KB
MD5

d496e867b4ad697a23e7d9a1b55f67b4
SHA1

7e8a534ef30b46df5e57783dd1c0c512cb39ebce
SHA256

de39459464d7c55b970dc1d251761a6e046ef78469d681a076217ee6f38749e2
SHA512

94db9911e6116c433b43e9f04f88f1a8fd48e4798892b8fc3080b205ebede2ff790cb363c797fc135f8b69408a6cd0284ff0462d0e1229e23966d43a9a70ae33
SSDEEP

6144:ckXpe/cCrUnYy6d/Z71KnByq7hozXRaOLFwZ5LhbgbNv+WDDVmQvZwhvkuFfkuuU:ErUnijWZ2ZwqSMuu8pS2xioZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	3052	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3052	1444	rundll32.exe	28
PID 1444 wrote to memory of 3052	1444	rundll32.exe	28
PID 1444 wrote to memory of 3052	1444	rundll32.exe	28
PID 1444 wrote to memory of 3052	1444	rundll32.exe	28
PID 1444 wrote to memory of 3052	1444	rundll32.exe	28
PID 1444 wrote to memory of 3052	1444	rundll32.exe	28
PID 1444 wrote to memory of 3052	1444	rundll32.exe	28
PID 3052 wrote to memory of 1696	3052	rundll32.exe	29
PID 3052 wrote to memory of 1696	3052	rundll32.exe	29
PID 3052 wrote to memory of 1696	3052	rundll32.exe	29
PID 3052 wrote to memory of 1696	3052	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avutil-56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\avutil-56.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 236
    3⤵
    - Program crash
    PID:1696