acac2e1bad58381fb4fa36027b7e9e8fb15158ef32f36533953f0e24068fe634

Analysis

max time kernel
92s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 07:18

Target

libopencv_calib3d220.dll
Size

1.1MB
MD5

abf06b83916f9363fbab50a0a772a821
SHA1

074e97910348ba07c4a9f8724a5a2f2afe99ede9
SHA256

5f3446a50249e588336304b422ff611b3011947df8982996f8c723637b858047
SHA512

65b21f2957d91da0f86dfdf7e8a73c7319ef1070a35bb29537cfb25fa4cf7d4b2e58f4a744ed5882e6e73a960084aba3f35ff6360d2957f5aace8afec44e5289
SSDEEP

24576:JlveAjoOL6QiAWZwW7MO7tTeqPJR1oITGgvdih1F/y1ZXgxpkYP+dPcpc:JFH4wW7MO7tTeqPJR1oITGgvdih1Fqrt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	4248	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4248	4200	rundll32.exe	84
PID 4200 wrote to memory of 4248	4200	rundll32.exe	84
PID 4200 wrote to memory of 4248	4200	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libopencv_calib3d220.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libopencv_calib3d220.dll,#1
  2⤵
  PID:4248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 604
    3⤵
    - Program crash
    PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4248 -ip 4248
1⤵
PID:3808

memory/4248-1-0x000000006E940000-0x000000006E950000-memory.dmp

Filesize
64KB

Download