bf9f383bd10ca183ccf932eb42f55b47403164b21cf17df3efd9508db38d3960

Resubmissions

08-05-2024 18:47

08-05-2024 18:39

max time kernel
130s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 18:47

Target

opencv_ffmpeg320.dll
Size

15.7MB
MD5

f081abd9d6ca7e425d340ce586f9c090
SHA1

7cf57b7e8ffc6fe9ef183bb2944062814000ed36
SHA256

c2573fbeb40156436ab64e8bf3df960bb8b237001b7a1402086b9714afb6d72f
SHA512

ed00878d52ae072fc357cf4b8b25a8e76bcc678df1d6a163ddbe9a0589222ac06965d63b8747d92953d227301ce8f740c436582de281b592b1a00f42510c0b5c
SSDEEP

196608:QCa2sOybspcrhVA2VooSZp8t8uF7jou83iAq/JMNjMDastAXZpxVy+oPkGZgqf4f:pQAj+Vt61AsEKeuXkpfQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3132	3900	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3900	4776	rundll32.exe	88
PID 4776 wrote to memory of 3900	4776	rundll32.exe	88
PID 4776 wrote to memory of 3900	4776	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\opencv_ffmpeg320.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\opencv_ffmpeg320.dll,#1
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 660
    3⤵
    - Program crash
    PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3900 -ip 3900
1⤵
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4940

memory/3900-0-0x0000000069B80000-0x000000006B298000-memory.dmp

Filesize
23.1MB

Download