a5472bb2e9ed011596aeda9be8cb8fea3bbf6b1299bff525fd3179bd7ef20eb0

Analysis

max time kernel
151s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-03-2023 16:12

Target

publish/bin/libbz2-1.dll
Size

72KB
MD5

ab0e3427ea209d61ab6b08617c99b47c
SHA1

65002276e4e14ac067c78cd9fac498454fca2c02
SHA256

cde82b78524ba83ba94743417883e03e3311713ac0af87b50f5bc0335c5b77b6
SHA512

e45585c7945e30b8a3095e756652c0ab98367196d82f54d4384438bcad5b62b22b66a5f4f9ba246117cdd0d69b466aceb27873d7b44d55902e27cbebe898d016
SSDEEP

768:4Vf3UyszRfpZwMVKC2AfFBqs65nZNcF3kFOh9Q8y4mWaIN23AVrQPxx5Ttx:euRfpCMVKBAfO5nQF3uyez4mVQ84ex

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1300 1320 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1300	1320	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1320 wrote to memory of 1300	1320	rundll32.exe	WerFault.exe
PID 1320 wrote to memory of 1300	1320	rundll32.exe	WerFault.exe
PID 1320 wrote to memory of 1300	1320	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libbz2-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1320 -s 84
2⤵
- Program crash
PID:1300

memory/1320-54-0x00000000626C0000-0x00000000626DA000-memory.dmp

Filesize
104KB

Download