e95c2508bab20b1fb478a24d4c4a3ee75bec5e1b8e7a0c66928948cec30773cf

Analysis

max time kernel
77s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2023 02:53

Target

happytime-onvif-server/happytime-rtsp-server/swscale-5.dll
Size

501KB
MD5

30a74b5dc5a7cad06c584f69d10eef7a
SHA1

f814737706aea2c2803e24b423344a8a0e94fb26
SHA256

8144506d22b54df61ad3684792d08c63cb151e6b8d32213cee224eb7d99747a5
SHA512

02039264c2fb5ff0831868c73608bee52d5d7f9ab76896e1865a8c0571327fd378df98d7f198483e2bb8b526cba042e765e492427eb13b3c3a03f1692e603c4d
SSDEEP

12288:tvwyqf/9FGgiw8ed+wya6khNyY6DRmx51JT6cZijgkiiMiiiiiKNrrrrrrrrjkiE:tYLf/9FGgiw8ed+wya6khNyY6DRmx51I

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4972 1696 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4972	1696	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4596 wrote to memory of 1696	4596	rundll32.exe	rundll32.exe
PID 4596 wrote to memory of 1696	4596	rundll32.exe	rundll32.exe
PID 4596 wrote to memory of 1696	4596	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\swscale-5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\swscale-5.dll,#1
2⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 620
3⤵
- Program crash
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1696 -ip 1696
1⤵
PID:5036