617f845935d428ecaf15057713f3d08a10f8257b90ee669a2afac591678bac30

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 18:40

Target

Video Enhancerv2013汉化绿色破解版/VDFilterPack/MSU_SmartDeblock_0.8.dll
Size

145KB
MD5

2beca38e12065908fa9c74c491c1a38a
SHA1

ff42f013234e4b34bfac3196490d6c00edd1d58d
SHA256

a30979f5a73b4d4b88cb2702fd5ada2947def4c59c8f7bfd06867711c51c413e
SHA512

fcfc32d4b35dffab66317bdbb79e07f3d41c264d8ae60ca01806b5214486ba8c51122f4e26d4dc138cee0f497065b414b99ecdfc1358f5f0ddd436b20d408054
SSDEEP

3072:7Y2bR0xgogQT3xCW0lZLrf1UgQZUYCvuFT/:c2bg33DgnqoO

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral31/memory/2664-0-0x0000000010000000-0x000000001005F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	2664	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 2664 wrote to memory of 1764	2664	rundll32.exe	32
PID 2664 wrote to memory of 1764	2664	rundll32.exe	32
PID 2664 wrote to memory of 1764	2664	rundll32.exe	32
PID 2664 wrote to memory of 1764	2664	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\VDFilterPack\MSU_SmartDeblock_0.8.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\VDFilterPack\MSU_SmartDeblock_0.8.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 224
    3⤵
    - Program crash
    PID:1764

memory/2664-0-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download