acac2e1bad58381fb4fa36027b7e9e8fb15158ef32f36533953f0e24068fe634

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 07:18

Target

libopencv_core220.dll
Size

5.5MB
MD5

459febb1ced954af495f8c011d55b85f
SHA1

5ac8155e325d5df3882c35883ac1d354d9c7a0bb
SHA256

085584dd6d0a44f2f9a2d9a483aa11e9fc7b88f55f6ff7a306d5186bcaafc5b8
SHA512

685e6fb6ab17ed0276a579eb6f1a213fd9f9374f5180fdd8a599d12c62fd1637fd9c93fc912f674583cfc4765c3f1eeb343c1508af2853c464688a47a3da815e
SSDEEP

98304:jN8eHXdBF5TVBkvTwn/41d2v0KqlAMc4/LcQBJmZ9sQQQC:B8eHXd94s/41d2v0KqlAMc4/DJmZ9sQy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	1760	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1760	1720	rundll32.exe	28
PID 1720 wrote to memory of 1760	1720	rundll32.exe	28
PID 1720 wrote to memory of 1760	1720	rundll32.exe	28
PID 1720 wrote to memory of 1760	1720	rundll32.exe	28
PID 1720 wrote to memory of 1760	1720	rundll32.exe	28
PID 1720 wrote to memory of 1760	1720	rundll32.exe	28
PID 1720 wrote to memory of 1760	1720	rundll32.exe	28
PID 1760 wrote to memory of 1764	1760	rundll32.exe	29
PID 1760 wrote to memory of 1764	1760	rundll32.exe	29
PID 1760 wrote to memory of 1764	1760	rundll32.exe	29
PID 1760 wrote to memory of 1764	1760	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libopencv_core220.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libopencv_core220.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 224
    3⤵
    - Program crash
    PID:1764

memory/1760-1-0x000000006E940000-0x000000006E950000-memory.dmp

Filesize
64KB

Download