a5472bb2e9ed011596aeda9be8cb8fea3bbf6b1299bff525fd3179bd7ef20eb0

Analysis

max time kernel
152s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-03-2023 16:12

Target

publish/bin/libexpat-1.dll
Size

248KB
MD5

c1323b5df48fdf9e3bf2f96625ee9408
SHA1

515d1c49fc4ace8a9d058d1b631c3193345b1708
SHA256

582e9c53f5ed594c80f5013ead3eacabe126316595063bb1976a5d5d52f0f0a0
SHA512

a0f28fd719b2bfbfb566d186553be4f6a0e5ad8cd36e8f219be4f7f255f5a59bc8320f12de3f9ebc62ec8020f060617d1e13ccc162d219e9f4386b3a3c2bca6e
SSDEEP

3072:iFNEx+eMFTJXFLfS1U3+LcyAfIwv0TEeiMkmxBBBBBBcWFppuoc/lF3C8:kBRfS1U3+LY6jEOBBBBBBcWMoc/lF3C8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1716 1508 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1716	1508	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1508 wrote to memory of 1716	1508	rundll32.exe	WerFault.exe
PID 1508 wrote to memory of 1716	1508	rundll32.exe	WerFault.exe
PID 1508 wrote to memory of 1716	1508	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libexpat-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1508 -s 84
2⤵
- Program crash
PID:1716

memory/1508-54-0x0000000068F40000-0x0000000068F86000-memory.dmp

Filesize
280KB

Download