61d524d5e2174ccf68635a5735c8e8084e3bbd605d23c5d14b2d93d5eaa49fce

Analysis

max time kernel
102s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2023 14:50

Target

libquadmath-0.dll
Size

309KB
MD5

3354b9256750a6b7d97ba30b4ad00717
SHA1

e518b655c83985cc607f624addbc8cb61f8faead
SHA256

b543942b4484d49b95f0ef72399e6ddbf49c7be54024af1e7d6001136a9145e6
SHA512

fb086f26cd0c1c92f012819ccdd045cc4b7d84ba1bdd5cf5665ebf11172f49e712ffe5a354872a24715978955ec9ff7e14c730df4f917502e5533a3ebcb105fc
SSDEEP

6144:UiMcnBcqngoBLqQiQZN9oal0+wbQXIqPP63I8MxpJIpe9aglmBiyRVRFjld:UidqwiQZN9oal0+wMZR8MxpxllyRVTj/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1168 992 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1168	992	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1608 wrote to memory of 992	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 992	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 992	1608	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libquadmath-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libquadmath-0.dll,#1
  2⤵
  PID:992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 600
    3⤵
    - Program crash
    PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 992 -ip 992
1⤵
PID:2728

memory/992-133-0x000000006CF00000-0x000000006CF54000-memory.dmp

Filesize
336KB

Download