3d30d701fb087416627321c60ab02f143718aefbb3ea7e2689b6fb658ab78ab6

Resubmissions

04-02-2023 21:43

max time kernel
34s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-02-2023 21:43

Target

VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgcc_s_seh-1.dll
Size

89KB
MD5

ee6dab9b460d8570cd10a017d850739d
SHA1

5ee005251c2aae9f63d3e2c7efed8d091f8f758f
SHA256

5a1f4f92d865ccc37c6e99342b3692cc0cd7f6ed6c108fa8ff559ddd72c7d2fa
SHA512

883f8d6c842ff8dcd26e093a404a39131a02d1e33ec45f5d187db05fec047c56f52798b923cdb90ea4b5a7e701f8fa454de6e6a7a6d5f710d55d31c432d69555
SSDEEP

1536:4x7W0l+4C1qZfonwhIX3H7S5T1eATyglkSu/dItMImTInr3gZ89JqsfAENRLzIxO:4xS0QbqCwSHq+3/dIVrwEqsF8FN09

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1748 1584 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1748	1584	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1584 wrote to memory of 1748	1584	rundll32.exe	WerFault.exe
PID 1584 wrote to memory of 1748	1584	rundll32.exe	WerFault.exe
PID 1584 wrote to memory of 1748	1584	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3\upl\app\fold\libgcc_s_seh-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1584 -s 84
  2⤵
  - Program crash
  PID:1748