385267a11cc318a791e7a74bf78f673ebbaec9fbec431f2dd796ffbdbb18a350

Resubmissions

21-11-2024 12:22

21-11-2024 12:19

max time kernel
10s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 12:19

Target

citra-windows-msvc-20240927-608383e\avformat-60.dll
Size

2.4MB
MD5

aaf5e285e8e8ed6a6e428b52728ed18e
SHA1

89794b8e834a617724f24aa18de745f413221045
SHA256

17e49a141502a26655cb3adec68c45ea19491e713eea13b1c3c35e458e77cc1d
SHA512

67cb2a03ab2740ed4f10955be1c2b7025f5e16e1eff7814fa6176458cc676dc892dc4b6d53ab0ac94be1c6176916f29b49d9dd3e1dd8e08c002d968c90eaf051
SSDEEP

49152:TDBYBDE5tkWtgMuciN7BIEb6hVk/aWRl4KtfCQ8JDYpzr:EAKf7YoaWL4KtfKWr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2236	2224	rundll32.exe	29
PID 2224 wrote to memory of 2236	2224	rundll32.exe	29
PID 2224 wrote to memory of 2236	2224	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\citra-windows-msvc-20240927-608383e\avformat-60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2224 -s 140
  2⤵
  PID:2236