c946192bf47377d97cc4aff9cc4e405acbd19aae30a1745be4b7fa7f230ad8c0

Analysis

max time kernel
154s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-05-2023 21:09

Target

publish/bin/libbz2-1.dll
Size

72KB
MD5

ab0e3427ea209d61ab6b08617c99b47c
SHA1

65002276e4e14ac067c78cd9fac498454fca2c02
SHA256

cde82b78524ba83ba94743417883e03e3311713ac0af87b50f5bc0335c5b77b6
SHA512

e45585c7945e30b8a3095e756652c0ab98367196d82f54d4384438bcad5b62b22b66a5f4f9ba246117cdd0d69b466aceb27873d7b44d55902e27cbebe898d016
SSDEEP

768:4Vf3UyszRfpZwMVKC2AfFBqs65nZNcF3kFOh9Q8y4mWaIN23AVrQPxx5Ttx:euRfpCMVKBAfO5nQF3uyez4mVQ84ex

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1152 1704 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1152	1704	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1704 wrote to memory of 1152	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 1152	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 1152	1704	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libbz2-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1704 -s 84
  2⤵
  - Program crash
  PID:1152

memory/1704-54-0x00000000626C0000-0x00000000626DA000-memory.dmp

Filesize
104KB

Download