fcacfcb9b89fc2a2cf20a3cbd7d6ea81a21fa938e3145893145aa9e1c9856ea8

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:17

Target

Sgi's Video Converter/Mplayer/libiconv-2.dll
Size

1.0MB
MD5

cb88eab061f4d299423d874dd8031805
SHA1

2ef0b98edbc0103137bcc794cc96c079bf618f11
SHA256

0182052af0b58d53372e637bee385d77f96ebd977b19f65f703e8c04b8f94b45
SHA512

c08a8ba57d25b6f81a0363bf4b276bf5e97440cfe79ee76d9fa887f46c778f88a10f601fc95c0d9961b058ba04355c89174d3a4a906f9a2cb56aeba55078c698
SSDEEP

24576:uTdWAuroX4BAUZLY7PwdKb3Gavkg3NywlTvbbTptuOfy9fVDn:uTdWAuroIBAUZLY74Ub3GaX/TFtuOC9n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	480	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 480	3064	rundll32.exe	28
PID 3064 wrote to memory of 480	3064	rundll32.exe	28
PID 3064 wrote to memory of 480	3064	rundll32.exe	28
PID 3064 wrote to memory of 480	3064	rundll32.exe	28
PID 3064 wrote to memory of 480	3064	rundll32.exe	28
PID 3064 wrote to memory of 480	3064	rundll32.exe	28
PID 3064 wrote to memory of 480	3064	rundll32.exe	28
PID 480 wrote to memory of 1640	480	rundll32.exe	29
PID 480 wrote to memory of 1640	480	rundll32.exe	29
PID 480 wrote to memory of 1640	480	rundll32.exe	29
PID 480 wrote to memory of 1640	480	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sgi's Video Converter\Mplayer\libiconv-2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sgi's Video Converter\Mplayer\libiconv-2.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 480 -s 224
    3⤵
    - Program crash
    PID:1640

memory/480-0-0x0000000066000000-0x00000000660FB000-memory.dmp

Filesize
1004KB

Download