5ae41d15101ad481c2122d277eb991e9db02e9d360da737d6d3ebc9a2182d00a

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 15:12

Target

Amcrest Surveillance Pro/opencv_imgproc2411.dll
Size

1.8MB
MD5

15162abd14bb45cb92cd300f69631539
SHA1

13b1f5edc93d217990ad356df4164a73efad4641
SHA256

942588906e1cf3ac22b9071afd8d5a498dd91a3e58a45145ae74b1fc1b9471da
SHA512

fc2bd627c65715b6b7381049a28fb66c83ae04f5fe640aaedaab32c11a24c7b7173e4418d927621464afd960ce5b8c3af15abf9699bbc78775d5a786609f299d
SSDEEP

24576:CMVjRDkrR5BpzIgy5GnbZe8mzG7dFcQQ+3H8qwQbPIRxtxF5Ke390rNB2/xqNYVl:CEjRm5B9by1ggQ83aYEWEDoT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4592	4780	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 4780	1580	rundll32.exe	81
PID 1580 wrote to memory of 4780	1580	rundll32.exe	81
PID 1580 wrote to memory of 4780	1580	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_imgproc2411.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\opencv_imgproc2411.dll",#1
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 612
    3⤵
    - Program crash
    PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4780 -ip 4780
1⤵
PID:4904

memory/4780-1-0x0000000002920000-0x0000000002B0D000-memory.dmp

Filesize
1.9MB

Download