86bfeefce2acee5d39d7bb93461eb5f93a81658579ceb4c8346bb77977f15ef2

Analysis

max time kernel
147s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2023 22:49

Target

publish/bin/libbz2-1.dll
Size

72KB
MD5

ab0e3427ea209d61ab6b08617c99b47c
SHA1

65002276e4e14ac067c78cd9fac498454fca2c02
SHA256

cde82b78524ba83ba94743417883e03e3311713ac0af87b50f5bc0335c5b77b6
SHA512

e45585c7945e30b8a3095e756652c0ab98367196d82f54d4384438bcad5b62b22b66a5f4f9ba246117cdd0d69b466aceb27873d7b44d55902e27cbebe898d016
SSDEEP

768:4Vf3UyszRfpZwMVKC2AfFBqs65nZNcF3kFOh9Q8y4mWaIN23AVrQPxx5Ttx:euRfpCMVKBAfO5nQF3uyez4mVQ84ex

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3616 3388 WerFault.exe rundll32.exe
1888 3388 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3616	3388	WerFault.exe	rundll32.exe
1888	3388	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3388 wrote to memory of 3616	3388	rundll32.exe	WerFault.exe
PID 3388 wrote to memory of 3616	3388	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libbz2-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3388

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3388 -s 328
2⤵
- Program crash
PID:3616

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3388 -s 328
2⤵
- Program crash
PID:1888

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 3388 -ip 3388
1⤵
PID:3672

memory/3388-133-0x00000000626C0000-0x00000000626DA000-memory.dmp

Filesize
104KB

Download