e95c2508bab20b1fb478a24d4c4a3ee75bec5e1b8e7a0c66928948cec30773cf

Analysis

max time kernel
111s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2023 02:53

Target

happytime-onvif-server/happytime-rtsp-server/srt.dll
Size

457KB
MD5

03afa01ad7b46ba39c48b8a81b162abf
SHA1

fdfccaf04a392b76ac65170d707e3b67176a245f
SHA256

17bd2f4eb133274f30285352718a33b57493e8bd504cb29f353fb9203b452515
SHA512

bc2c3442e356ca99f07043a1b8a0b04a30111a546700ba8d7c6392e590ff520d69c1910be1cca28f9cdaf3ff183dc20681422bcbad793c97d72f1a605eb07ccd
SSDEEP

12288:yOr4ebVIB0NrnxO9/0P9kL1PiOn2ZtuHAmV47T6B69uAa0PN5U84/hF0tLwJa5Vd:Xr4cVC0lOJmgZyciCwDgy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5112 3020 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5112	3020	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3920 wrote to memory of 3020	3920	rundll32.exe	rundll32.exe
PID 3920 wrote to memory of 3020	3920	rundll32.exe	rundll32.exe
PID 3920 wrote to memory of 3020	3920	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\srt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\srt.dll,#1
2⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 628
3⤵
- Program crash
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3020 -ip 3020
1⤵
PID:1396