041fc3abf8578ddcead5a8c4a8be8960b7c4d45b21d3370ee2683605e86a728c

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 14:01

Target

scrcpy-win64-v2.6.1/avutil-59.dll
Size

1011KB
MD5

3414cf66d64154b50b4d52b892af0f6b
SHA1

54fb4b03bf52298b3c4cb9b8b4d2ff6775fa17c7
SHA256

eac3a2142455cd79caa43e8e7277aa5831df30d3b1407d30719be65fc5927256
SHA512

f5fe021699d8e427710d9185adb84e6321510eee6f339c8c6e06af9e8a4a42023e1c6bedd8c3e79e8ad1916da15c47579a13da457a893aeaa23364dd5427ae78
SSDEEP

12288:zx7QohAXyg6BJUT94fgfa6C9P01o3SmXRvv9TspznP1:zufXSBJUT94fga6C92oCYR8R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.6.1\avutil-59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2636 -s 96
  2⤵
  PID:2656

memory/2636-0-0x000007FEF36C0000-0x000007FEF47D6000-memory.dmp

Filesize
17.1MB

Download