a5472bb2e9ed011596aeda9be8cb8fea3bbf6b1299bff525fd3179bd7ef20eb0

Analysis

max time kernel
159s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-03-2023 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

publish/bin/libcairo-2.dll
Size

991KB
MD5

011adbf1bcf6ecf533b429ab3a06cb4f
SHA1

cc3acdcec4103e3e9bb85c1814c17704b95862db
SHA256

751c93bc9e36ee73f30d24c13729afa1e8ceb6527706b2bd23df363dd5830304
SHA512

5fa08f6b4f276fadd1a0c3b95186a46ed57ddc9d1fc4f819fa4e3845d26c58b322943f8beabd11f118b6612a202857427499ac6469b491f2dd53541a0c117db2
SSDEEP

24576:90614pb4CZNZuZ5uCkFnWXPiJ0iEmsCn3UxMTfzLz:90M4pUCTZubuIXe0iEmsCnNTfzLz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 2000 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1956	2000	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 1956	2000	rundll32.exe	WerFault.exe
PID 2000 wrote to memory of 1956	2000	rundll32.exe	WerFault.exe
PID 2000 wrote to memory of 1956	2000	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libcairo-2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2000 -s 172
2⤵
- Program crash
PID:1956

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x0000000068DC0000-0x0000000068EBE000-memory.dmp

Filesize
1016KB

Download
memory/2000-56-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/2000-57-0x0000000064F80000-0x0000000064FCE000-memory.dmp

Filesize
312KB

Download
memory/2000-55-0x0000000061440000-0x000000006145C000-memory.dmp

Filesize
112KB

Download
memory/2000-58-0x0000000068F40000-0x0000000068F86000-memory.dmp

Filesize
280KB

Download
memory/2000-59-0x00000000693C0000-0x0000000069473000-memory.dmp

Filesize
716KB

Download
memory/2000-60-0x00000000626C0000-0x00000000626DA000-memory.dmp

Filesize
104KB

Download
memory/2000-61-0x0000000061600000-0x0000000061712000-memory.dmp

Filesize
1.1MB

Download
memory/2000-62-0x00000000649C0000-0x0000000064AE5000-memory.dmp

Filesize
1.1MB

Download
memory/2000-63-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

Filesize
160KB

Download
memory/2000-64-0x0000000066000000-0x000000006610B000-memory.dmp

Filesize
1.0MB

Download
memory/2000-66-0x0000000070540000-0x000000007056D000-memory.dmp

Filesize
180KB

Download
memory/2000-65-0x0000000069140000-0x000000006918E000-memory.dmp

Filesize
312KB

Download
memory/2000-67-0x000000006FC40000-0x000000006FDA5000-memory.dmp

Filesize
1.4MB

Download
memory/2000-68-0x0000000068B40000-0x0000000068B80000-memory.dmp

Filesize
256KB

Download
memory/2000-69-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download
memory/2000-70-0x0000000063500000-0x00000000635AC000-memory.dmp

Filesize
688KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads