5ae41d15101ad481c2122d277eb991e9db02e9d360da737d6d3ebc9a2182d00a

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 15:12

Target

Amcrest Surveillance Pro/opencv_core2411.dll
Size

1.9MB
MD5

8f698b2d5eaa8ac4cc43ac3142704663
SHA1

0a87bcbfdf825c6650f8ab205f1f6f752b606fe0
SHA256

543694cbcf20952160103737e9e1d81e2a89d99730a72c86afc613c96c78309b
SHA512

87cc835e9b71f712285d25d80b863e0308a0860fd3157410b76a16851af769edbe0d1d6075eea8db90baafc08bc914840997480ee5faeaa949aa5e481afbf532
SSDEEP

49152:veJ5SpDDkh/5wrvlV46/EssIrDTVtgUYhrgl:c5Y8Z5wr9Vd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2128	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2128	2084	rundll32.exe	28
PID 2084 wrote to memory of 2128	2084	rundll32.exe	28
PID 2084 wrote to memory of 2128	2084	rundll32.exe	28
PID 2084 wrote to memory of 2128	2084	rundll32.exe	28
PID 2084 wrote to memory of 2128	2084	rundll32.exe	28
PID 2084 wrote to memory of 2128	2084	rundll32.exe	28
PID 2084 wrote to memory of 2128	2084	rundll32.exe	28
PID 2128 wrote to memory of 2364	2128	rundll32.exe	29
PID 2128 wrote to memory of 2364	2128	rundll32.exe	29
PID 2128 wrote to memory of 2364	2128	rundll32.exe	29
PID 2128 wrote to memory of 2364	2128	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_core2411.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_core2411.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 228
    3⤵
    - Program crash
    PID:2364