ae4c8d37a496b43f8974ba8f07f708e22a9570ba0cddc3dc3a36edbccd4d2a20

Analysis

max time kernel
142s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/04/2023, 00:42

Target

scrcpy-win64-v2.0/avformat-60.dll
Size

495KB
MD5

16b04703e965f7ef0619929f335f5346
SHA1

b905f8ff2a3d1f0e6a6c76831e124b70f3b6ca8f
SHA256

873072d1e592421784058486b6568cfc64e9a7d7354703d825c5c63c22051178
SHA512

02d78adbce07f8db7a0db20a677112526ac50157b464ae6b0b1869f6ce8622f9ad11c42f814d843e6ac1b808fdfd930e8e6fce6fcc38b447a27ae5367d895fec
SSDEEP

12288:F5R4sVoZX6Zz3Il0W+Q4ePKIo/SdEyiFxLGEiT:rRIZwuPKSdYjQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1188	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1720	1188	rundll32.exe	28
PID 1188 wrote to memory of 1720	1188	rundll32.exe	28
PID 1188 wrote to memory of 1720	1188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\avformat-60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1188 -s 132
  2⤵
  - Program crash
  PID:1720

memory/1188-54-0x000007FEF74A0000-0x000007FEF7524000-memory.dmp

Filesize
528KB

Download
memory/1188-55-0x000007FEFB850000-0x000007FEFB87A000-memory.dmp

Filesize
168KB

Download
memory/1188-56-0x000007FEF6EF0000-0x000007FEF7249000-memory.dmp

Filesize
3.3MB

Download
memory/1188-57-0x000007FEF6CE0000-0x000007FEF6EE3000-memory.dmp

Filesize
2.0MB

Download
memory/1188-58-0x000007FEFB7B0000-0x000007FEFB7D7000-memory.dmp

Filesize
156KB

Download