c946192bf47377d97cc4aff9cc4e405acbd19aae30a1745be4b7fa7f230ad8c0

Analysis

max time kernel
206s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-05-2023 01:21

Target

publish/bin/libexpat-1.dll
Size

248KB
MD5

c1323b5df48fdf9e3bf2f96625ee9408
SHA1

515d1c49fc4ace8a9d058d1b631c3193345b1708
SHA256

582e9c53f5ed594c80f5013ead3eacabe126316595063bb1976a5d5d52f0f0a0
SHA512

a0f28fd719b2bfbfb566d186553be4f6a0e5ad8cd36e8f219be4f7f255f5a59bc8320f12de3f9ebc62ec8020f060617d1e13ccc162d219e9f4386b3a3c2bca6e
SSDEEP

3072:iFNEx+eMFTJXFLfS1U3+LcyAfIwv0TEeiMkmxBBBBBBcWFppuoc/lF3C8:kBRfS1U3+LY6jEOBBBBBBcWMoc/lF3C8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 1192 WerFault.exe rundll32.exe

pid	pid_target	process	target process
852	1192	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1192 wrote to memory of 852	1192	rundll32.exe	WerFault.exe
PID 1192 wrote to memory of 852	1192	rundll32.exe	WerFault.exe
PID 1192 wrote to memory of 852	1192	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libexpat-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1192 -s 84
  2⤵
  - Program crash
  PID:852

memory/1192-54-0x0000000068F40000-0x0000000068F86000-memory.dmp

Filesize
280KB

Download