ae4c8d37a496b43f8974ba8f07f708e22a9570ba0cddc3dc3a36edbccd4d2a20 | Triage

Analysis

max time kernel
141s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 12:49

Sharing

Report Analysis Logs

General

Target

scrcpy-win64-v2.0/zlib1.dll
Size

132KB
MD5

1daf87a334e32bc0813f7b494b53d258
SHA1

81fa9b20c8847162dffac9c733405db8c7e5688c
SHA256

5968380fd70941f53d36a2f6cc666f28240a32b03761db9c4c5256ac2e339638
SHA512

7729312ce5769b9f78807265df4f0a32efdfcdd3df2ef1fba303421793eb944758840db1777f03517223b69596934ad7b4efffa057563cd3c3e9d2e9d07f4d72
SSDEEP

3072:OVFUs57gm44/YmMHQ6tMah2tQoRYR5JvD93:OXtVgmEQ4cQokD9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1244	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1312	1244	rundll32.exe	28
PID 1244 wrote to memory of 1312	1244	rundll32.exe	28
PID 1244 wrote to memory of 1312	1244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1244 -s 84
  2⤵
  - Program crash
  PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-54-0x000007FEF6B50000-0x000007FEF6B7A000-memory.dmp

Filesize
168KB

Download