9742689a50e96ddc04d80ceff046b28da2beefd617be18166f8c5e715ec60c59

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 06:13

Target
libvlc.dll
Size 189KB
Sample240809-gysj4a1dpg
SHA256 095d164633af53ac015dcd76540e8523744f57d506db111f19b3fdd9d6180833
MD5 264a9e0194dbd3c0540d67b156ecaaba
SHA1 4f1e7609e3ad169550e082fa35d08a7457a528a0
SHA512 2d1e8a98b8183b76f1b7fe4c8aedae69f903f29cb0e578f82399c5a1e817f479c5e45904f6f1e736b300a9e6d9d33c2caa4b60cb87b0cde3f03321f881c4945c
SSDEEP 3072:MM6pRaubfTPeuD6spsr8VERyc8LQWJLyLMBs1sI:MMAHTTGWI0cyczgLyLR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2896	2872	rundll32.exe	30
PID 2872 wrote to memory of 2896	2872	rundll32.exe	30
PID 2872 wrote to memory of 2896	2872	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 120
  2⤵
  PID:2896

memory/2872-0-0x000007FEF7C20000-0x000007FEF7C54000-memory.dmp

Download

memory/2872-1-0x000007FEF65D0000-0x000007FEF6886000-memory.dmp

Download