5ae41d15101ad481c2122d277eb991e9db02e9d360da737d6d3ebc9a2182d00a

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 15:12 UTC

Target

Amcrest Surveillance Pro/opencv_imgproc2411.dll
Size

1.8MB
MD5

15162abd14bb45cb92cd300f69631539
SHA1

13b1f5edc93d217990ad356df4164a73efad4641
SHA256

942588906e1cf3ac22b9071afd8d5a498dd91a3e58a45145ae74b1fc1b9471da
SHA512

fc2bd627c65715b6b7381049a28fb66c83ae04f5fe640aaedaab32c11a24c7b7173e4418d927621464afd960ce5b8c3af15abf9699bbc78775d5a786609f299d
SSDEEP

24576:CMVjRDkrR5BpzIgy5GnbZe8mzG7dFcQQ+3H8qwQbPIRxtxF5Ke390rNB2/xqNYVl:CEjRm5B9by1ggQ83aYEWEDoT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	2172	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2172 wrote to memory of 2468	2172	rundll32.exe	29
PID 2172 wrote to memory of 2468	2172	rundll32.exe	29
PID 2172 wrote to memory of 2468	2172	rundll32.exe	29
PID 2172 wrote to memory of 2468	2172	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_imgproc2411.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_imgproc2411.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 232
    3⤵
    - Program crash
    PID:2468

memory/2172-0-0x0000000002010000-0x00000000021FD000-memory.dmp

Filesize
1.9MB

Download