e0ab6ef803903b6866fb2dcddf7352e06fedc088a2b8314f7829cc9f83f2a22e

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 16:50

Target

FLVScreenVideo.dll
Size

83KB
MD5

74283d568c482660a7387a16df4c2571
SHA1

3e90d7eae27f480cbeb57d05ca809d7ac6032e30
SHA256

174a460339148532fd8b24c89010c65d6cc1c2085c509247ae86a3e868a22c11
SHA512

b02cc2a43fd0fe0c09a0572b7de95a09883568442a89b8bcd97ef0eb6a1b98301957ab428a8515a431fa6c7d96e692d68b1d9f0dd7038f39efe01537087cc00f
SSDEEP

768:Fprc+386kY5ma78ct+JnIn2FrT447OCRUYNSIRgVV2ChHkYqoWDT2Enuy6VA0fJH:FW+3z4OCncHkIeT7nh6JfJfOSyNoxFx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	2576	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2576	3588	rundll32.exe	82
PID 3588 wrote to memory of 2576	3588	rundll32.exe	82
PID 3588 wrote to memory of 2576	3588	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FLVScreenVideo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FLVScreenVideo.dll,#1
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 600
    3⤵
    - Program crash
    PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2576 -ip 2576
1⤵
PID:1304