617f845935d428ecaf15057713f3d08a10f8257b90ee669a2afac591678bac30

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 18:40

Target

Video Enhancerv2013汉化绿色破解版/VDFilterPack/2DCLEAN.dll
Size

40KB
MD5

a876be788d59ebe8b0645e322751ccc4
SHA1

f4b0ad8533055abd1f8e062b025c41621a36578b
SHA256

fe2841b46768df45e63e6215b571cda5369aa23e0fdd662d70e847d260e690f2
SHA512

701377fb35d8cd774f235cf07e11ed5bc0fde0ad60e22e40c37f4e34bc4f0ac814fe24b6dc09f705247fae5709faae96b0f43952033b2d3f42c01a023ea7a7d6
SSDEEP

768:YQyljgWsCTcUvPBemSEJoaXj1zWfZoU9IWd5jmj:YUCTcUnBemVOaZuoAd5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	1708	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1708	1732	rundll32.exe	30
PID 1732 wrote to memory of 1708	1732	rundll32.exe	30
PID 1732 wrote to memory of 1708	1732	rundll32.exe	30
PID 1732 wrote to memory of 1708	1732	rundll32.exe	30
PID 1732 wrote to memory of 1708	1732	rundll32.exe	30
PID 1732 wrote to memory of 1708	1732	rundll32.exe	30
PID 1732 wrote to memory of 1708	1732	rundll32.exe	30
PID 1708 wrote to memory of 1932	1708	rundll32.exe	31
PID 1708 wrote to memory of 1932	1708	rundll32.exe	31
PID 1708 wrote to memory of 1932	1708	rundll32.exe	31
PID 1708 wrote to memory of 1932	1708	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\VDFilterPack\2DCLEAN.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\VDFilterPack\2DCLEAN.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 224
    3⤵
    - Program crash
    PID:1932