af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 10:37

Target
FFModules/avcodec-52.dll
Size 7.3MB
Sample240612-mn9zaavepr
SHA256 84ddc7e62dfc9d53303f8529c7cd18a6dfb903319dfe5eb76c9fb29a5276cf7a
MD5 6a19de42841e5dd62bd134a68f9a6438
SHA1 1973e9f19d2855d33a0faffc5edf0b00ec84ca27
SHA512 85f8a4b2189bf4ad93fecd45bdd33c7ca77e167e61bf10e4086c4fa24ee49d7a8b1cde9f408ab2d44871661e1febdff2554a828729897793429e84d74a9cac86
SSDEEP 98304:qIHTgq5gTXcwExx8mahrUW3ExjVRV2SW0dBU7y0AHKBUGjkvSABpPgDanqlNwfpV:XhmEvHRnjV/1BKHkvSABpPsanKy7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	2792	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2792 wrote to memory of 2852	2792	rundll32.exe	29
PID 2792 wrote to memory of 2852	2792	rundll32.exe	29
PID 2792 wrote to memory of 2852	2792	rundll32.exe	29
PID 2792 wrote to memory of 2852	2792	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\avcodec-52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\avcodec-52.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 224
    3⤵
    - Program crash
    PID:2852

memory/2792-0-0x0000000000130000-0x0000000000145000-memory.dmp

Download

memory/2792-1-0x000000006AD40000-0x000000006B8FC000-memory.dmp

Download

memory/2792-2-0x000000006AD40000-0x000000006B8FC000-memory.dmp

Download

memory/2792-5-0x0000000061180000-0x000000006118E000-memory.dmp

Download

memory/2792-4-0x0000000000130000-0x0000000000145000-memory.dmp

Download