5ae41d15101ad481c2122d277eb991e9db02e9d360da737d6d3ebc9a2182d00a

Analysis

max time kernel
118s
max time network
155s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 15:12

Target

Amcrest Surveillance Pro/msvcm80.dll
Size

504KB
MD5

60a6de55aa50d57a01b7148b0a7ea139
SHA1

da30628428724cd281151a60a361b27617b26508
SHA256

2fa2a2a4a0511493c5a360e66c7d62f0ea5891925636eac61cd9db09dbed5637
SHA512

376758a45744d2d3b9ef2d81387cffc1abc44753a1299550b1ccee47cbecf137c897510eb361693e518aac3348424ccb3cac3493d938a503a767eef96f5a3cc0
SSDEEP

6144:fQ2z1hZVqvjKlmjKbLhc/rSVMuPvgTlAh+zbUZyd/+O9LuMIjDOgzprhfXycrsXS:ffzTZGjKlmjKbLmjSVMK06h+fU3Xvo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2644	2736	rundll32.exe	30
PID 2736 wrote to memory of 2644	2736	rundll32.exe	30
PID 2736 wrote to memory of 2644	2736	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\msvcm80.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 164
  2⤵
  PID:2644