ae4c8d37a496b43f8974ba8f07f708e22a9570ba0cddc3dc3a36edbccd4d2a20

Analysis

max time kernel
141s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 12:49

Target

scrcpy-win64-v2.0/msys-usb-1.0.dll
Size

216KB
MD5

3eb215e257262f0fdd0cc0f25ed31103
SHA1

446148d5212a5ad2919771915506e8f6d2af9ad8
SHA256

cb2971f37f0d47c89ea1b5729f11cc9f4a8311ebfb8139521b667120b12a589d
SHA512

34a6d8746a6a3d5fc8e83d92999492a347835d9be392ececab08cc6e2f0131aeb869ed8a5af71e2c7679cefdb04d185344f709befe59df0201acd54a41ca1f8a
SSDEEP

3072:/xdSJruVOcVNE5OGE2zpt53/N291TKNWuLaOgTChdZBxV/4a:/vS0VOcVy5O8bGTTKIOaHidx3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	1204	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\msys-usb-1.0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1204 -s 84
  2⤵
  - Program crash
  PID:1264

memory/1204-54-0x0000000070980000-0x00000000709B4000-memory.dmp

Filesize
208KB

Download