Analysis
-
max time kernel
111s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26/01/2023, 03:06
General
-
Target
happytime-onvif-server/zlibwapi.dll
-
Size
382KB
-
MD5
7b0fac1968dcc7627636f3d17682c71a
-
SHA1
1a80eac3d98824f76caa8ac9a3040e802f05e26a
-
SHA256
2ef3a3ca1c9b442048b7d00856f2dab69a7be8787cc6f26f2d554adb73ac545e
-
SHA512
7d80cf5ce353158146c4cabdfabf2dc54c99badcc952029e3d20cb1a21ce0405b91f4ac9fbe29c20fd832da541faa33678d133e079f4faab20005dd70b9b5048
-
SSDEEP
6144:GLVeNa307jXrapwILWL9pMCsVohOn81Za7PGW698TB5vC0Tzh:g36jALWL9OCmohOnqcGW698TPvC0
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\zlibwapi.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\zlibwapi.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 6003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 756 -ip 7561⤵