e95c2508bab20b1fb478a24d4c4a3ee75bec5e1b8e7a0c66928948cec30773cf

Analysis

max time kernel
67s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2023 02:53

Target

happytime-onvif-server/happytime-rtsp-server/avcodec-58.dll
Size

29.6MB
MD5

f6e03136925b2115c5bf16c3d350d9ed
SHA1

4bbeee92496d3a20f266d297cdb58518bbfe0726
SHA256

eed8c8a64549ffdfbc620b4ff6833e58b25d5c1123786c05fbc7be1f12743758
SHA512

353008cfff9789986177c718bd6bbdb6184780c0e6b3d8f7f361314a6e8bff116bdbd79e94d8218c0bec73612adac7523876fc4e09e472127dc7947b193882cd
SSDEEP

393216:YVbJv2NcGjFg23Xs0qUANf0//O5U0zvhkHxc3gSEkSa0Lpb/GdMX:YbKjHCkO5U0zpkHxcHwYdM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4984 4004 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4984	4004	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2060 wrote to memory of 4004	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 4004	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 4004	2060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\avcodec-58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\avcodec-58.dll,#1
2⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 636
3⤵
- Program crash
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4004 -ip 4004
1⤵
PID:1428