e95c2508bab20b1fb478a24d4c4a3ee75bec5e1b8e7a0c66928948cec30773cf

Analysis

max time kernel
112s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2023 02:53

Target

happytime-onvif-server/happytime-rtsp-server/swresample-3.dll
Size

316KB
MD5

4f3bd5b9c1b10a966908a1d1b0db7411
SHA1

6c31e74d3cb2abb75f2ecee933c8544c484761f5
SHA256

660e5963d0be63bdcea50e959c23fd93b8c25d582ff49e5af9e0fce84294dfe9
SHA512

77b8357a249deba39fbf94a94c00d5f3e3ae861d58411c25278f144f3022ddca3c27bb21d6a6a89a4239dc89f2956b9a5083346a286a5469f3863bdb05260bd5
SSDEEP

6144:NNfWE1yQKJdyKqIi3AhrX49fCWM1xiWs7hjy+NY9S+yCod7yHVWjtEjPFpHEP/nN:NNfWE1yQKJdyKqIi3AhrX49fsxuu89C0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 748 wrote to memory of 1780	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1780	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1780	748	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\swresample-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\swresample-3.dll,#1
2⤵
PID:1780