c946192bf47377d97cc4aff9cc4e405acbd19aae30a1745be4b7fa7f230ad8c0

Analysis

max time kernel
125s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 01:21

Target

publish/bin/libcroco-0.6-3.dll
Size

237KB
MD5

b481ed028dc922313ae96606f4ac3d9c
SHA1

32cf5c65bc3e67e05cd4ecd6579ba1cb6de4c728
SHA256

736524dd0b26a566c60965850a82d341dc7af61c150fee3f9a4e73dd4ba96b66
SHA512

9b5a779992263cf81680560dcc01a85c5e45a20faf8fdee3adff967e656ab84bdd033e539e1123745504855d4405cd0e0a06257f478c2acf6ce64c58b2db74d3
SSDEEP

3072:aff7k9QBQWwMAnkk7SmddFP8rfHA8pYvNm7pN0A8fCcKni9GtzxiVAkfWLFMMKSz:affVVfJk7SyKfHOquYMFbzSiI

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1308 2708 WerFault.exe rundll32.exe
3592 2708 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1308	2708	WerFault.exe	rundll32.exe
3592	2708	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2708 wrote to memory of 1308	2708	rundll32.exe	WerFault.exe
PID 2708 wrote to memory of 1308	2708	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libcroco-0.6-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2708 -s 256
  2⤵
  - Program crash
  PID:1308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2708 -s 256
  2⤵
  - Program crash
  PID:3592

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 2708 -ip 2708
1⤵
PID:2712

memory/2708-133-0x0000000066440000-0x0000000066483000-memory.dmp

Filesize
268KB

Download
memory/2708-134-0x00000000649C0000-0x0000000064AE5000-memory.dmp

Filesize
1.1MB

Download
memory/2708-135-0x0000000070F40000-0x0000000071087000-memory.dmp

Filesize
1.3MB

Download
memory/2708-136-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

Filesize
160KB

Download
memory/2708-137-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/2708-138-0x0000000063CC0000-0x0000000063CEC000-memory.dmp

Filesize
176KB

Download
memory/2708-139-0x0000000066000000-0x000000006610B000-memory.dmp

Filesize
1.0MB

Download
memory/2708-140-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download
memory/2708-141-0x0000000069140000-0x000000006918E000-memory.dmp

Filesize
312KB

Download