4f5c33b54a841bae7acb0e8216de5120a5b068ac60cfd158eca260d1f83cf067

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 08:45

Target

1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/DVR.exe
Size

96KB
MD5

924329ec1dbf39d38db800125f32808e
SHA1

421593985a6602cd73ab263d5669c168b8d37e1a
SHA256

d4fb3aa593cc8c493aaa8ca767b8d8556e68ddfd15a3616422435d1c4ad735aa
SHA512

bae62d29461215d985cd1852768994679512a8a8a0cb4dc69708efb6be979393512042c880b9fc6e6debfc34e1452a3b9d75cc3faff4642c07f4a48f7366bf1c
SSDEEP

1536:CJsR4bLpoma63rPHhoC9JZPtqljS2ky4dWExgYJtp343gABiaO:Rioma67PHrojp4cEx5zNAXVO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2636 1984 WerFault.exe DVR.exe

pid	pid_target	process	target process
2636	1984	WerFault.exe	DVR.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DVR.exe

description	pid	process	target process
PID 1984 wrote to memory of 2636	1984	DVR.exe	WerFault.exe
PID 1984 wrote to memory of 2636	1984	DVR.exe	WerFault.exe
PID 1984 wrote to memory of 2636	1984	DVR.exe	WerFault.exe
PID 1984 wrote to memory of 2636	1984	DVR.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\DVR.exe
"C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\DVR.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 36
2⤵
- Program crash
PID:2636

memory/1984-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download