a5472bb2e9ed011596aeda9be8cb8fea3bbf6b1299bff525fd3179bd7ef20eb0

Analysis

max time kernel
161s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-03-2023 16:12

Target

publish/bin/libcroco-0.6-3.dll
Size

237KB
MD5

b481ed028dc922313ae96606f4ac3d9c
SHA1

32cf5c65bc3e67e05cd4ecd6579ba1cb6de4c728
SHA256

736524dd0b26a566c60965850a82d341dc7af61c150fee3f9a4e73dd4ba96b66
SHA512

9b5a779992263cf81680560dcc01a85c5e45a20faf8fdee3adff967e656ab84bdd033e539e1123745504855d4405cd0e0a06257f478c2acf6ce64c58b2db74d3
SSDEEP

3072:aff7k9QBQWwMAnkk7SmddFP8rfHA8pYvNm7pN0A8fCcKni9GtzxiVAkfWLFMMKSz:affVVfJk7SyKfHOquYMFbzSiI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

524 296 WerFault.exe rundll32.exe

pid	pid_target	process	target process
524	296	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 296 wrote to memory of 524	296	rundll32.exe	WerFault.exe
PID 296 wrote to memory of 524	296	rundll32.exe	WerFault.exe
PID 296 wrote to memory of 524	296	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libcroco-0.6-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:296

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 296 -s 168
2⤵
- Program crash
PID:524

memory/296-54-0x0000000066440000-0x0000000066483000-memory.dmp

Filesize
268KB

Download
memory/296-55-0x00000000649C0000-0x0000000064AE5000-memory.dmp

Filesize
1.1MB

Download
memory/296-56-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

Filesize
160KB

Download
memory/296-57-0x0000000066000000-0x000000006610B000-memory.dmp

Filesize
1.0MB

Download
memory/296-58-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/296-59-0x0000000069140000-0x000000006918E000-memory.dmp

Filesize
312KB

Download
memory/296-60-0x0000000070F40000-0x0000000071087000-memory.dmp

Filesize
1.3MB

Download
memory/296-61-0x0000000063CC0000-0x0000000063CEC000-memory.dmp

Filesize
176KB

Download
memory/296-62-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download