5ae41d15101ad481c2122d277eb991e9db02e9d360da737d6d3ebc9a2182d00a

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 15:12

Target

Amcrest Surveillance Pro/msvcp100.dll
Size

593KB
MD5

caed4a65caf1ef80aa81e9b135326658
SHA1

a3daf85194d0b149a91e13ba83a5e4a8968427ac
SHA256

a55f33a3a03273a8ba957506946a6b7e51576eb76e588e8de8c14fa46a886860
SHA512

2ce82b3df6c29d84fb9b12c92aa8dafdeab36d21a9d3c4acaf87b70b8acc53cc81537ef39b75ee674ee44b00a2853d7434216fa55bdd7ba17a6d8fbc76d4a8a3
SSDEEP

12288:YjPZyWVFYzxJ783DPO7fYxiMjNGgcskVk87y+vEKZm+aWodEE6cY:Y1ygYzxJ783DsIrcsTl+vEKZm+aWodEL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2560	2764	rundll32.exe	28
PID 2764 wrote to memory of 2560	2764	rundll32.exe	28
PID 2764 wrote to memory of 2560	2764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\msvcp100.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2764 -s 80
  2⤵
  PID:2560