c946192bf47377d97cc4aff9cc4e405acbd19aae30a1745be4b7fa7f230ad8c0

Analysis

max time kernel
148s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-05-2023 21:09

Target

publish/bin/libatk-1.0-0.dll
Size

136KB
MD5

ce9ab2defa6d7a584152a54108c30bfc
SHA1

8b221ad2c5c428c0b73b30f9fbebd1a99186c8f1
SHA256

2a80279b8dbeec1bb9b4121ccd4801034599184dab1c9166d5a29df1fd819df9
SHA512

10a9d8e4ad9d120260273f70c2a820c10429cff86ba770ffe1cb0f57097175e1367c52b7f7a97ac29e62b09f08a2799f3c43faf9df25dd44d39fed44b25ecd89
SSDEEP

1536:lQ/IMw1Tk3vQeJEMq8iMjIV9WBmF/9yjr7YrDn8KBBIxpRu63GQsU9jDQn7BmCoU:6ETWvrEMq8iMjIfKjArDnP0EzUxDGMvU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

924 1772 WerFault.exe rundll32.exe

pid	pid_target	process	target process
924	1772	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1772 wrote to memory of 924	1772	rundll32.exe	WerFault.exe
PID 1772 wrote to memory of 924	1772	rundll32.exe	WerFault.exe
PID 1772 wrote to memory of 924	1772	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libatk-1.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1772 -s 184
  2⤵
  - Program crash
  PID:924

memory/1772-54-0x000000006BD40000-0x000000006BD69000-memory.dmp

Filesize
164KB

Download
memory/1772-55-0x00000000649C0000-0x0000000064AE5000-memory.dmp

Filesize
1.1MB

Download
memory/1772-56-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

Filesize
160KB

Download
memory/1772-57-0x0000000066000000-0x000000006610B000-memory.dmp

Filesize
1.0MB

Download
memory/1772-58-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/1772-59-0x0000000069140000-0x000000006918E000-memory.dmp

Filesize
312KB

Download
memory/1772-60-0x0000000067F00000-0x0000000067F57000-memory.dmp

Filesize
348KB

Download
memory/1772-61-0x000000006B740000-0x000000006B750000-memory.dmp

Filesize
64KB

Download