5ae41d15101ad481c2122d277eb991e9db02e9d360da737d6d3ebc9a2182d00a

Analysis

max time kernel
45s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 15:12

Target

Amcrest Surveillance Pro/opencv_highgui2411.dll
Size

1.8MB
MD5

99cb69e23b571bcc57fc3105985c49f5
SHA1

0e913e897b31f55d0d366d18917251786178e4d4
SHA256

0f78a593fa2f6ef8a50130a5c1c69450c5c0431e232d914b21a6feea6f48e800
SHA512

92fea9c681771f072760b673dd197bf52f57bd1fced1db74584f431322b48b904886f9c58e146fe88dd4a8c03cafaa15065e6337934de9f38f2875d69f883269
SSDEEP

24576:vEM/VtsGTrfRrIh5t7+pwZTS3HO+ImiZiA0b1kXV02RNNb3TMy8N8tMqKTytPRQV:Yh+psS3HO+Imi2oV02RNJmlT4RQ2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	1196	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 1196	3832	rundll32.exe	82
PID 3832 wrote to memory of 1196	3832	rundll32.exe	82
PID 3832 wrote to memory of 1196	3832	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_highgui2411.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_highgui2411.dll",#1
  2⤵
  PID:1196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 760
    3⤵
    - Program crash
    PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1196 -ip 1196
1⤵
PID:2012

memory/1196-0-0x0000000002AE0000-0x0000000002CCD000-memory.dmp

Filesize
1.9MB

Download