bf9f383bd10ca183ccf932eb42f55b47403164b21cf17df3efd9508db38d3960

Resubmissions

08/05/2024, 18:47

08/05/2024, 18:39

max time kernel
91s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 18:39

Target

opencv_ffmpeg320.dll
Size

15.7MB
MD5

f081abd9d6ca7e425d340ce586f9c090
SHA1

7cf57b7e8ffc6fe9ef183bb2944062814000ed36
SHA256

c2573fbeb40156436ab64e8bf3df960bb8b237001b7a1402086b9714afb6d72f
SHA512

ed00878d52ae072fc357cf4b8b25a8e76bcc678df1d6a163ddbe9a0589222ac06965d63b8747d92953d227301ce8f740c436582de281b592b1a00f42510c0b5c
SSDEEP

196608:QCa2sOybspcrhVA2VooSZp8t8uF7jou83iAq/JMNjMDastAXZpxVy+oPkGZgqf4f:pQAj+Vt61AsEKeuXkpfQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	3344	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3344	2072	rundll32.exe	80
PID 2072 wrote to memory of 3344	2072	rundll32.exe	80
PID 2072 wrote to memory of 3344	2072	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\opencv_ffmpeg320.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\opencv_ffmpeg320.dll,#1
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 660
    3⤵
    - Program crash
    PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3344 -ip 3344
1⤵
PID:948

memory/3344-0-0x0000000069B80000-0x000000006B298000-memory.dmp

Filesize
23.1MB

Download