ae4c8d37a496b43f8974ba8f07f708e22a9570ba0cddc3dc3a36edbccd4d2a20

Analysis

max time kernel
36s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 12:49

Target

scrcpy-win64-v2.0/scrcpy.exe
Size

630KB
MD5

4d6c680202c8407ef795aaf816cf6796
SHA1

bcb1106d2bc1f56a4cce847ac8d1fa3df570c3fb
SHA256

a94bd1b33b809e8fd43c7f600ad0a077708f37a4ee95b07626c3eca054d0f2a9
SHA512

2407a93a99b5228c2bf0b494b4206dfecc46883ecae25ed5fc2c3a75f348b592aa5281f38019c82bbcd495a3189e09b8d4128266adb98a2ee5470ececba0d13b
SSDEEP

12288:HHNWvtvC3XQXroltQZaflpKhxbTXZk40jusCT:HMQ3XQ7oltcoKhZMjusCT

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1448	1352	scrcpy.exe	29
PID 1352 wrote to memory of 1448	1352	scrcpy.exe	29
PID 1352 wrote to memory of 1448	1352	scrcpy.exe	29
PID 1352 wrote to memory of 1448	1352	scrcpy.exe	29
PID 1448 wrote to memory of 924	1448	adb.exe	30
PID 1448 wrote to memory of 924	1448	adb.exe	30
PID 1448 wrote to memory of 924	1448	adb.exe	30
PID 1448 wrote to memory of 924	1448	adb.exe	30
PID 1352 wrote to memory of 468	1352	scrcpy.exe	31
PID 1352 wrote to memory of 468	1352	scrcpy.exe	31
PID 1352 wrote to memory of 468	1352	scrcpy.exe	31
PID 1352 wrote to memory of 468	1352	scrcpy.exe	31

C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\scrcpy.exe
"C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\scrcpy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\adb.exe
  adb start-server
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\adb.exe
    adb -L tcp:5037 fork-server server --reply-fd 240
    3⤵
    PID:924
- C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\adb.exe
  adb devices -l
  2⤵
  PID:468

memory/1352-57-0x000000013F720000-0x000000013F82D000-memory.dmp

Filesize
1.1MB

Download
memory/1352-58-0x000007FEF6990000-0x000007FEF6BFE000-memory.dmp

Filesize
2.4MB

Download
memory/1352-59-0x000007FEF60C0000-0x000007FEF6419000-memory.dmp

Filesize
3.3MB

Download
memory/1352-60-0x000007FEFB1C0000-0x000007FEFB1EA000-memory.dmp

Filesize
168KB

Download
memory/1352-61-0x000007FEF5EB0000-0x000007FEF60B3000-memory.dmp

Filesize
2.0MB

Download
memory/1352-62-0x000007FEFB150000-0x000007FEFB177000-memory.dmp

Filesize
156KB

Download
memory/1352-64-0x0000000070980000-0x00000000709B4000-memory.dmp

Filesize
208KB

Download
memory/1352-63-0x000007FEFAC10000-0x000007FEFAC94000-memory.dmp

Filesize
528KB

Download