5ae41d15101ad481c2122d277eb991e9db02e9d360da737d6d3ebc9a2182d00a

Analysis

max time kernel
144s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 15:12

Target

Amcrest Surveillance Pro/opencv_core2411.dll
Size

1.9MB
MD5

8f698b2d5eaa8ac4cc43ac3142704663
SHA1

0a87bcbfdf825c6650f8ab205f1f6f752b606fe0
SHA256

543694cbcf20952160103737e9e1d81e2a89d99730a72c86afc613c96c78309b
SHA512

87cc835e9b71f712285d25d80b863e0308a0860fd3157410b76a16851af769edbe0d1d6075eea8db90baafc08bc914840997480ee5faeaa949aa5e481afbf532
SSDEEP

49152:veJ5SpDDkh/5wrvlV46/EssIrDTVtgUYhrgl:c5Y8Z5wr9Vd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3212	752	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 752	4912	rundll32.exe	89
PID 4912 wrote to memory of 752	4912	rundll32.exe	89
PID 4912 wrote to memory of 752	4912	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_core2411.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_core2411.dll",#1
  2⤵
  PID:752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 604
    3⤵
    - Program crash
    PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 752 -ip 752
1⤵
PID:1468