e0ab6ef803903b6866fb2dcddf7352e06fedc088a2b8314f7829cc9f83f2a22e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 16:50

Target

FLVScreenVideo.dll
Size

83KB
MD5

74283d568c482660a7387a16df4c2571
SHA1

3e90d7eae27f480cbeb57d05ca809d7ac6032e30
SHA256

174a460339148532fd8b24c89010c65d6cc1c2085c509247ae86a3e868a22c11
SHA512

b02cc2a43fd0fe0c09a0572b7de95a09883568442a89b8bcd97ef0eb6a1b98301957ab428a8515a431fa6c7d96e692d68b1d9f0dd7038f39efe01537087cc00f
SSDEEP

768:Fprc+386kY5ma78ct+JnIn2FrT447OCRUYNSIRgVV2ChHkYqoWDT2Enuy6VA0fJH:FW+3z4OCncHkIeT7nh6JfJfOSyNoxFx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2236	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2236	1896	rundll32.exe	28
PID 1896 wrote to memory of 2236	1896	rundll32.exe	28
PID 1896 wrote to memory of 2236	1896	rundll32.exe	28
PID 1896 wrote to memory of 2236	1896	rundll32.exe	28
PID 1896 wrote to memory of 2236	1896	rundll32.exe	28
PID 1896 wrote to memory of 2236	1896	rundll32.exe	28
PID 1896 wrote to memory of 2236	1896	rundll32.exe	28
PID 2236 wrote to memory of 2748	2236	rundll32.exe	29
PID 2236 wrote to memory of 2748	2236	rundll32.exe	29
PID 2236 wrote to memory of 2748	2236	rundll32.exe	29
PID 2236 wrote to memory of 2748	2236	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FLVScreenVideo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FLVScreenVideo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 220
    3⤵
    - Program crash
    PID:2748