3d30d701fb087416627321c60ab02f143718aefbb3ea7e2689b6fb658ab78ab6

Resubmissions

04-02-2023 21:43

max time kernel
22s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-02-2023 21:43

Target

VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgmp-10.dll
Size

622KB
MD5

d0cfb628f3a6033f7a45ee841c1161de
SHA1

b7b6d82ab924b0130fdcbade148f3220faf3c1a8
SHA256

cc04e8e3190335b7be885d175f62e1fd8bae1deeca4e660a4df85bf7c286221e
SHA512

2e987acd0ff8d1e6d336c1bc9c24af5cbbe49094365b1e09b3efc3735fbba76a3806ec66c8478664412e51700477d788947d8d557f3dec1d2d08d4685c2f5b35
SSDEEP

6144:gqCGo2jbRSFZxZ3S9fO4yciqIJuYpvTHq7yXE/0vk5bBGslJ6NoUuUPaT1QANbr0:BRsx8iP0/GkW/uUi6Al6G+Jh3WU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1096	1228	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3\upl\app\fold\libgmp-10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1228 -s 84
  2⤵
  - Program crash
  PID:1096