4f5c33b54a841bae7acb0e8216de5120a5b068ac60cfd158eca260d1f83cf067

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 08:45

Target

1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR Player.exe
Size

652KB
MD5

ac92ddcd004d45551749cada041690da
SHA1

7dab7a193f5b37a39fa97fa9aaef948b1bd3eced
SHA256

c93ba430f498527e38cd144582eea82f535c1156c94ab8c42f113347cf94363e
SHA512

e94af2a0e2e222f5867dca52fde601b88db2dbfc57dbc5b9a4318b2d22886da694eebbd8219ea12cdd9f05d7098b0ee74125d774fbd51addeec2069e6723475a
SSDEEP

12288:yQHgAZ26oWvXP254EuWxkJWWWHLgW8WmWWWWUW3W2WWVXWWWWkWnWWWWWWWWWWWR:dHtZ26Dvf25GWxkJWWWHLgW8WmWWWWUP

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 2068 WerFault.exe DVR Player.exe

pid	pid_target	process	target process
1956	2068	WerFault.exe	DVR Player.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DVR Player.exe

description	pid	process	target process
PID 2068 wrote to memory of 1956	2068	DVR Player.exe	WerFault.exe
PID 2068 wrote to memory of 1956	2068	DVR Player.exe	WerFault.exe
PID 2068 wrote to memory of 1956	2068	DVR Player.exe	WerFault.exe
PID 2068 wrote to memory of 1956	2068	DVR Player.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR Player.exe
"C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR Player.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 172
2⤵
- Program crash
PID:1956

memory/2068-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download