ae4c8d37a496b43f8974ba8f07f708e22a9570ba0cddc3dc3a36edbccd4d2a20

Analysis

max time kernel
140s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 12:49

Target

scrcpy-win64-v2.0/avutil-58.dll
Size

934KB
MD5

fb549fb8ac01e54e336e6b2dc51bc47e
SHA1

d69c3142f6c95e6cde2d7d76c3a064f44edeab1c
SHA256

0db8e0fd50b636958b303df5af377413b1d16b4f85fff20b53beeae4dd6f3109
SHA512

5a7511c57ef954d17eba7cf349fb71006a5e099112ed332cd364690d8a55ba906c903135aa465c7ec374624d0e09542a184a911162738b8bbc08ec31a2f9ad3a
SSDEEP

12288:gExniE7Yjo3bGyUnfpbqid0mVqOvPJyuCp34RM4uvQaMSJ1:gEhiE7B3bGTnfpuid0MtJE3zn91

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	1324	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1376	1324	rundll32.exe	28
PID 1324 wrote to memory of 1376	1324	rundll32.exe	28
PID 1324 wrote to memory of 1376	1324	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\avutil-58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1324 -s 100
  2⤵
  - Program crash
  PID:1376

memory/1324-54-0x000007FEF6BF0000-0x000007FEF6DF3000-memory.dmp

Filesize
2.0MB

Download