041fc3abf8578ddcead5a8c4a8be8960b7c4d45b21d3370ee2683605e86a728c

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 14:01

Target
scrcpy-win64-v2.6.1/avutil-59.dll
Size 1011KB
Sample240829-rb2vcsvgjg
SHA256 eac3a2142455cd79caa43e8e7277aa5831df30d3b1407d30719be65fc5927256
MD5 3414cf66d64154b50b4d52b892af0f6b
SHA1 54fb4b03bf52298b3c4cb9b8b4d2ff6775fa17c7
SHA512 f5fe021699d8e427710d9185adb84e6321510eee6f339c8c6e06af9e8a4a42023e1c6bedd8c3e79e8ad1916da15c47579a13da457a893aeaa23364dd5427ae78
SSDEEP 12288:zx7QohAXyg6BJUT94fgfa6C9P01o3SmXRvv9TspznP1:zufXSBJUT94fga6C92oCYR8R
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.6.1\avutil-59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2636 -s 96
  2⤵
  PID:2656