c946192bf47377d97cc4aff9cc4e405acbd19aae30a1745be4b7fa7f230ad8c0

Analysis

max time kernel
147s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-05-2023 21:09

Target

publish/bin/libcroco-0.6-3.dll
Size

237KB
MD5

b481ed028dc922313ae96606f4ac3d9c
SHA1

32cf5c65bc3e67e05cd4ecd6579ba1cb6de4c728
SHA256

736524dd0b26a566c60965850a82d341dc7af61c150fee3f9a4e73dd4ba96b66
SHA512

9b5a779992263cf81680560dcc01a85c5e45a20faf8fdee3adff967e656ab84bdd033e539e1123745504855d4405cd0e0a06257f478c2acf6ce64c58b2db74d3
SSDEEP

3072:aff7k9QBQWwMAnkk7SmddFP8rfHA8pYvNm7pN0A8fCcKni9GtzxiVAkfWLFMMKSz:affVVfJk7SyKfHOquYMFbzSiI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1996 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2028	1996	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1996 wrote to memory of 2028	1996	rundll32.exe	WerFault.exe
PID 1996 wrote to memory of 2028	1996	rundll32.exe	WerFault.exe
PID 1996 wrote to memory of 2028	1996	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libcroco-0.6-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1996 -s 168
  2⤵
  - Program crash
  PID:2028

memory/1996-54-0x0000000066440000-0x0000000066483000-memory.dmp

Filesize
268KB

Download
memory/1996-55-0x00000000649C0000-0x0000000064AE5000-memory.dmp

Filesize
1.1MB

Download
memory/1996-56-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

Filesize
160KB

Download
memory/1996-57-0x0000000066000000-0x000000006610B000-memory.dmp

Filesize
1.0MB

Download
memory/1996-59-0x0000000069140000-0x000000006918E000-memory.dmp

Filesize
312KB

Download
memory/1996-60-0x0000000070F40000-0x0000000071087000-memory.dmp

Filesize
1.3MB

Download
memory/1996-58-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/1996-61-0x0000000063CC0000-0x0000000063CEC000-memory.dmp

Filesize
176KB

Download
memory/1996-62-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download