ae4c8d37a496b43f8974ba8f07f708e22a9570ba0cddc3dc3a36edbccd4d2a20 | Triage

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 12:49

Sharing

Report Analysis Logs

General

Target

scrcpy-win64-v2.0/avcodec-60.dll
Size

3.0MB
MD5

e50398267d35880d711df9647fe5dc02
SHA1

8bdd5dff1dd825e3b0c9985ae593cdd59028ba88
SHA256

2686b603a8544493d064449486175b910d79f11630489791d635a621149b9619
SHA512

fe4381faee9c89a2ec5c47340cee6100afcf6af381e6d742a48f02770a002f7acfb4d575cd9071f43ac2fcce12bbb723caae9f8688195a574aba7c7ed5ee4826
SSDEEP

49152:F8O062u2ygwDDAymr9mXl97KFCRWBg9HFTLRtJb+rJA:f0I9Xd9TteJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	1956	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1920	1956	rundll32.exe	27
PID 1956 wrote to memory of 1920	1956	rundll32.exe	27
PID 1956 wrote to memory of 1920	1956	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\avcodec-60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1956 -s 132
  2⤵
  - Program crash
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-54-0x000007FEF64A0000-0x000007FEF67F9000-memory.dmp

Filesize
3.3MB

Download
memory/1956-55-0x000007FEFB7E0000-0x000007FEFB80A000-memory.dmp

Filesize
168KB

Download
memory/1956-56-0x000007FEF6C90000-0x000007FEF6E93000-memory.dmp

Filesize
2.0MB

Download
memory/1956-57-0x000007FEFB7B0000-0x000007FEFB7D7000-memory.dmp

Filesize
156KB

Download