ae4c8d37a496b43f8974ba8f07f708e22a9570ba0cddc3dc3a36edbccd4d2a20

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 12:49

Target

scrcpy-win64-v2.0/scrcpy.exe
Size

630KB
MD5

4d6c680202c8407ef795aaf816cf6796
SHA1

bcb1106d2bc1f56a4cce847ac8d1fa3df570c3fb
SHA256

a94bd1b33b809e8fd43c7f600ad0a077708f37a4ee95b07626c3eca054d0f2a9
SHA512

2407a93a99b5228c2bf0b494b4206dfecc46883ecae25ed5fc2c3a75f348b592aa5281f38019c82bbcd495a3189e09b8d4128266adb98a2ee5470ececba0d13b
SSDEEP

12288:HHNWvtvC3XQXroltQZaflpKhxbTXZk40jusCT:HMQ3XQ7oltcoKhZMjusCT

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1388	4372	scrcpy.exe	84
PID 4372 wrote to memory of 1388	4372	scrcpy.exe	84
PID 4372 wrote to memory of 1388	4372	scrcpy.exe	84
PID 1388 wrote to memory of 1156	1388	adb.exe	85
PID 1388 wrote to memory of 1156	1388	adb.exe	85
PID 1388 wrote to memory of 1156	1388	adb.exe	85
PID 4372 wrote to memory of 2612	4372	scrcpy.exe	86
PID 4372 wrote to memory of 2612	4372	scrcpy.exe	86
PID 4372 wrote to memory of 2612	4372	scrcpy.exe	86

C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\scrcpy.exe
"C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\scrcpy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\adb.exe
  adb start-server
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\adb.exe
    adb -L tcp:5037 fork-server server --reply-fd 600
    3⤵
    PID:1156
- C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\adb.exe
  adb devices -l
  2⤵
  PID:2612

memory/4372-136-0x00007FF602AD0000-0x00007FF602BDD000-memory.dmp

Filesize
1.1MB

Download
memory/4372-137-0x00007FF84F620000-0x00007FF84F6A4000-memory.dmp

Filesize
528KB

Download
memory/4372-138-0x00007FF84EAE0000-0x00007FF84ED4E000-memory.dmp

Filesize
2.4MB

Download
memory/4372-139-0x00007FF84E8D0000-0x00007FF84EAD3000-memory.dmp

Filesize
2.0MB

Download
memory/4372-140-0x0000000070980000-0x00000000709B4000-memory.dmp

Filesize
208KB

Download
memory/4372-141-0x00007FF84E570000-0x00007FF84E8C9000-memory.dmp

Filesize
3.3MB

Download
memory/4372-142-0x00007FF84FB40000-0x00007FF84FB67000-memory.dmp

Filesize
156KB

Download
memory/4372-143-0x00007FF84E510000-0x00007FF84E53A000-memory.dmp

Filesize
168KB

Download