617f845935d428ecaf15057713f3d08a10f8257b90ee669a2afac591678bac30

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 18:40

Target

Video Enhancerv2013汉化绿色破解版/VDFilterPack/MSU_Cartoonizer.dll
Size

286KB
MD5

5706db66c45c9cdcdba26e5eec7ba716
SHA1

f0ff9181a4e32f506748a2b56ac186d498b9ecb0
SHA256

8ea1feb85463ae92ea0a7913aaff7ac885a4097674d34530fd4ae1b1234c099e
SHA512

2408b654b2fd46d9ad92e9b1dd7000be27f2d4ea2b90b04f350164236912513619e15d3fb50f2584a3eccb5e58989e660f5bdc9fdc2a92675085a8c2c0ebd7b4
SSDEEP

6144:SHNs4dz8v/dCopEX7Gg68z0ZPFjGYpGcab11Iqa3UV19o:Sts4dz8v/dCopIG38Q7jGYwp5F+A9o

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral30/memory/3792-0-0x0000000010000000-0x0000000010126000-memory.dmp	upx
behavioral30/memory/3792-1-0x0000000010000000-0x0000000010126000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	3792	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3792	4476	rundll32.exe	84
PID 4476 wrote to memory of 3792	4476	rundll32.exe	84
PID 4476 wrote to memory of 3792	4476	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\VDFilterPack\MSU_Cartoonizer.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\VDFilterPack\MSU_Cartoonizer.dll",#1
  2⤵
  PID:3792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 616
    3⤵
    - Program crash
    PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3792 -ip 3792
1⤵
PID:4220

memory/3792-0-0x0000000010000000-0x0000000010126000-memory.dmp

Filesize
1.1MB

Download
memory/3792-1-0x0000000010000000-0x0000000010126000-memory.dmp

Filesize
1.1MB

Download