9701f1af05c7b542db0e2c5af4a62e818749f0ad67c4988ba5c6573dcb1aae85

Analysis

max time kernel
87s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 13:21

Target

Xf1_0_3/x86/opencv_ffmpeg310.dll
Size

11.9MB
MD5

89c783eee1c47bfc733f08334ec2e31c
SHA1

48f3ae37e58c6be4b7cbd775e77706636eb8a3e9
SHA256

c11139cdac81b6299f1756c04e7b9e9047f1e2ce37d18d8fc04421bcb0e9b297
SHA512

4b3441e9c18af534b09c4b13ca6fe4961f5a5cb873751d8bf343f2e6d10c5f054bd77964d4d77389972717ab72772670ce88f76cad5bbf600bfc83c899edbc6d
SSDEEP

196608:ltVj67SO81OIHexLvh52x0c6i3VeEkchbbyg1mW1mcjHvI7uiERpP/nY+yF:x+Lh5Fc6yuAreHERpnY+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3520	3608	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3608	4620	rundll32.exe	78
PID 4620 wrote to memory of 3608	4620	rundll32.exe	78
PID 4620 wrote to memory of 3608	4620	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xf1_0_3\x86\opencv_ffmpeg310.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xf1_0_3\x86\opencv_ffmpeg310.dll,#1
  2⤵
  PID:3608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 644
    3⤵
    - Program crash
    PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3608 -ip 3608
1⤵
PID:4576

memory/3608-133-0x0000000070FC0000-0x000000007220D000-memory.dmp

Filesize
18.3MB

Download