acac2e1bad58381fb4fa36027b7e9e8fb15158ef32f36533953f0e24068fe634

Analysis

max time kernel
135s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 07:18

Target

libopencv_core220.dll
Size

5.5MB
MD5

459febb1ced954af495f8c011d55b85f
SHA1

5ac8155e325d5df3882c35883ac1d354d9c7a0bb
SHA256

085584dd6d0a44f2f9a2d9a483aa11e9fc7b88f55f6ff7a306d5186bcaafc5b8
SHA512

685e6fb6ab17ed0276a579eb6f1a213fd9f9374f5180fdd8a599d12c62fd1637fd9c93fc912f674583cfc4765c3f1eeb343c1508af2853c464688a47a3da815e
SSDEEP

98304:jN8eHXdBF5TVBkvTwn/41d2v0KqlAMc4/LcQBJmZ9sQQQC:B8eHXd94s/41d2v0KqlAMc4/DJmZ9sQy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	2632	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2632	4100	rundll32.exe	84
PID 4100 wrote to memory of 2632	4100	rundll32.exe	84
PID 4100 wrote to memory of 2632	4100	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libopencv_core220.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libopencv_core220.dll,#1
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 604
    3⤵
    - Program crash
    PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2632 -ip 2632
1⤵
PID:3400

memory/2632-1-0x000000006E940000-0x000000006E950000-memory.dmp

Filesize
64KB

Download