e95c2508bab20b1fb478a24d4c4a3ee75bec5e1b8e7a0c66928948cec30773cf

Analysis

max time kernel
112s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2023, 03:06

Target

happytime-onvif-server/happytime-rtsp-server/avutil-56.dll
Size

653KB
MD5

04aaeea12c475dfa1466941833a1cc86
SHA1

43da5a8c0a2a922002d91280589b4dcbc906d293
SHA256

3b7d41584f47295ac5f800c3481d5662519d8729720bffe77f53a0c5d9589208
SHA512

6304a2aeb37cb32a0ff7e1c360a411fc38b4cdb08e085bb6a89f1e090a8ce5a0baeb203a6144ed6d5fbde63bd5a011d0df4f2a7b37c4517011c340ec195cf09f
SSDEEP

12288:j+T88wHM+RsWJWYYzVzJnCOO5/vY75Ash6HM+RAJgAniCk:j+oPHM+RsCRYGDY9Ash6MJgAg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4044	516	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 516	3612	rundll32.exe	79
PID 3612 wrote to memory of 516	3612	rundll32.exe	79
PID 3612 wrote to memory of 516	3612	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\avutil-56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\avutil-56.dll,#1
  2⤵
  PID:516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 616
    3⤵
    - Program crash
    PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 516 -ip 516
1⤵
PID:4656