5ae41d15101ad481c2122d277eb991e9db02e9d360da737d6d3ebc9a2182d00a | Triage

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 15:12 UTC

Sharing

Report Analysis Logs

General

Target

Amcrest Surveillance Pro/msvcr110.dll
Size

829KB
MD5

7c3b449f661d99a9b1033a14033d2987
SHA1

6c8c572e736bc53d1b5a608d3d9f697b1bb261da
SHA256

ae996edb9b050677c4f82d56092efdc75f0addc97a14e2c46753e2db3f6bd732
SHA512

a58783f50176e97284861860628cc930a613168be70411fabafbe6970dcccb8698a6d033cfc94edf415093e51f3d6a4b1ee0f38cc81254bdccb7edfa2e4db4f8
SSDEEP

24576:I+9BbHqWVFlB7s2ncm9NBrqWJgS0wzsYmyy6OQ:z9d7M3nS0wV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2084	2284	rundll32.exe	28
PID 2284 wrote to memory of 2084	2284	rundll32.exe	28
PID 2284 wrote to memory of 2084	2284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\msvcr110.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2284 -s 80
  2⤵
  PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads