4f5c33b54a841bae7acb0e8216de5120a5b068ac60cfd158eca260d1f83cf067

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 08:45

Target

1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/encode.exe
Size

4.1MB
MD5

3cc71ec1f6b6b0751ce3d97e8ee78977
SHA1

15261133c3fd7c7348a66d0acce90b034b1fe963
SHA256

0a4199680b932764af6ab901f4afddf1bcbf57a42e8584ced1a5b45ceb900105
SHA512

6ea848e7a430776bf8313fcce3edff58264c85ff88acbdde46f9a3eb03807039a479f1aefdc946f60351f0b1534848ad4ef57a51d4fb2e181c8d6d72e1502676
SSDEEP

98304:ky/rd9r6yMIlv//ODotFGGGRYzwllbllFFFFQoiii4k0OllRll:k

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2056 1368 WerFault.exe encode.exe

pid	pid_target	process	target process
2056	1368	WerFault.exe	encode.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

encode.exe

description	pid	process	target process
PID 1368 wrote to memory of 2056	1368	encode.exe	WerFault.exe
PID 1368 wrote to memory of 2056	1368	encode.exe	WerFault.exe
PID 1368 wrote to memory of 2056	1368	encode.exe	WerFault.exe
PID 1368 wrote to memory of 2056	1368	encode.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\encode.exe
"C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\encode.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 268
2⤵
- Program crash
PID:2056