9742689a50e96ddc04d80ceff046b28da2beefd617be18166f8c5e715ec60c59

Analysis

max time kernel
145s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 06:13

Target
libvlccore.dll
Size 2.7MB
Sample240809-gysj4a1dpg
SHA256 2ddb85b36650f85b5a09724c5b17428b1b1b76bd3e3dd85b643933659d5e333d
MD5 c62c3ef5753af6e0980f38eebc196b1c
SHA1 fd1d62feaaacb7cad5f952b61a6f7bd60d6dc4e1
SHA512 f2338d26b073d8a796a7a19ee290b87b63f30f6cfa62e74d147756d2362898a167784c860d9bc098b1ec1a080aaa0fad25ca8c611b7e8f42ea8195c2b14abdfc
SSDEEP 49152:0F0rn/mnSnjfazU2TGlMo1PBAUZLY6sEZGaXBuQQ9eI:0F07L60PBAUZL3W
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1792	2796	rundll32.exe	29
PID 2796 wrote to memory of 1792	2796	rundll32.exe	29
PID 2796 wrote to memory of 1792	2796	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlccore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2796 -s 124
  2⤵
  PID:1792

memory/2796-0-0x000007FEF6120000-0x000007FEF63D6000-memory.dmp

Download