fcacfcb9b89fc2a2cf20a3cbd7d6ea81a21fa938e3145893145aa9e1c9856ea8

Analysis

max time kernel
91s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 15:17

Target

Sgi's Video Converter/Mplayer/libiconv-2.dll
Size

1.0MB
MD5

cb88eab061f4d299423d874dd8031805
SHA1

2ef0b98edbc0103137bcc794cc96c079bf618f11
SHA256

0182052af0b58d53372e637bee385d77f96ebd977b19f65f703e8c04b8f94b45
SHA512

c08a8ba57d25b6f81a0363bf4b276bf5e97440cfe79ee76d9fa887f46c778f88a10f601fc95c0d9961b058ba04355c89174d3a4a906f9a2cb56aeba55078c698
SSDEEP

24576:uTdWAuroX4BAUZLY7PwdKb3Gavkg3NywlTvbbTptuOfy9fVDn:uTdWAuroIBAUZLY74Ub3GaX/TFtuOC9n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4920	3208	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3208	1964	rundll32.exe	83
PID 1964 wrote to memory of 3208	1964	rundll32.exe	83
PID 1964 wrote to memory of 3208	1964	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sgi's Video Converter\Mplayer\libiconv-2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sgi's Video Converter\Mplayer\libiconv-2.dll",#1
  2⤵
  PID:3208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 600
    3⤵
    - Program crash
    PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3208 -ip 3208
1⤵
PID:3756

memory/3208-0-0x0000000066000000-0x00000000660FB000-memory.dmp

Filesize
1004KB

Download