40415b1bc53572d6d1f47d64f6b14e27a12b3f016f24f3fa3fe3244bbfdfe5cb

Analysis

max time kernel
159s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-03-2023 00:05

Target

publish/bin/libatk-1.0-0.dll
Size

136KB
MD5

ce9ab2defa6d7a584152a54108c30bfc
SHA1

8b221ad2c5c428c0b73b30f9fbebd1a99186c8f1
SHA256

2a80279b8dbeec1bb9b4121ccd4801034599184dab1c9166d5a29df1fd819df9
SHA512

10a9d8e4ad9d120260273f70c2a820c10429cff86ba770ffe1cb0f57097175e1367c52b7f7a97ac29e62b09f08a2799f3c43faf9df25dd44d39fed44b25ecd89
SSDEEP

1536:lQ/IMw1Tk3vQeJEMq8iMjIV9WBmF/9yjr7YrDn8KBBIxpRu63GQsU9jDQn7BmCoU:6ETWvrEMq8iMjIfKjArDnP0EzUxDGMvU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

928 1108 WerFault.exe rundll32.exe

pid	pid_target	process	target process
928	1108	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1108 wrote to memory of 928	1108	rundll32.exe	WerFault.exe
PID 1108 wrote to memory of 928	1108	rundll32.exe	WerFault.exe
PID 1108 wrote to memory of 928	1108	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libatk-1.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1108 -s 184
  2⤵
  - Program crash
  PID:928

memory/1108-54-0x000000006BD40000-0x000000006BD69000-memory.dmp

Filesize
164KB

Download
memory/1108-55-0x00000000649C0000-0x0000000064AE5000-memory.dmp

Filesize
1.1MB

Download
memory/1108-56-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

Filesize
160KB

Download
memory/1108-57-0x0000000066000000-0x000000006610B000-memory.dmp

Filesize
1.0MB

Download
memory/1108-58-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/1108-59-0x0000000069140000-0x000000006918E000-memory.dmp

Filesize
312KB

Download
memory/1108-60-0x0000000067F00000-0x0000000067F57000-memory.dmp

Filesize
348KB

Download
memory/1108-61-0x000000006B740000-0x000000006B750000-memory.dmp

Filesize
64KB

Download