5ae41d15101ad481c2122d277eb991e9db02e9d360da737d6d3ebc9a2182d00a

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 15:12

Target

Amcrest Surveillance Pro/msvcp140.dll
Size

618KB
MD5

9ff712c25312821b8aec84c4f8782a34
SHA1

1a7a250d92a59c3af72a9573cffec2fcfa525f33
SHA256

517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094
SHA512

5a65da337e64ea42bcc461b411ae622ce4dec1036638b1e5de4757b366875d7f13c1290f2ee345f358994f648c5941db35aa5d2313f547605508fd2bcc047e33
SSDEEP

12288:eNQSZJrC30ovvjPo9E/YZt4QEKZm+jWodEEV2qwcg5MpccRwLM:0Z2jPo96QEKZm+jWodEEYqwcg5Mpck9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2404	2248	rundll32.exe	28
PID 2248 wrote to memory of 2404	2248	rundll32.exe	28
PID 2248 wrote to memory of 2404	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Amcrest Surveillance Pro\msvcp140.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2248 -s 80
  2⤵
  PID:2404