c946192bf47377d97cc4aff9cc4e405acbd19aae30a1745be4b7fa7f230ad8c0

Analysis

max time kernel
143s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 01:21

Target

publish/bin/libexpat-1.dll
Size

248KB
MD5

c1323b5df48fdf9e3bf2f96625ee9408
SHA1

515d1c49fc4ace8a9d058d1b631c3193345b1708
SHA256

582e9c53f5ed594c80f5013ead3eacabe126316595063bb1976a5d5d52f0f0a0
SHA512

a0f28fd719b2bfbfb566d186553be4f6a0e5ad8cd36e8f219be4f7f255f5a59bc8320f12de3f9ebc62ec8020f060617d1e13ccc162d219e9f4386b3a3c2bca6e
SSDEEP

3072:iFNEx+eMFTJXFLfS1U3+LcyAfIwv0TEeiMkmxBBBBBBcWFppuoc/lF3C8:kBRfS1U3+LY6jEOBBBBBBcWMoc/lF3C8

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1796 4084 WerFault.exe rundll32.exe
1628 4084 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1796	4084	WerFault.exe	rundll32.exe
1628	4084	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4084 wrote to memory of 1796	4084	rundll32.exe	WerFault.exe
PID 4084 wrote to memory of 1796	4084	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libexpat-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4084 -s 328
  2⤵
  - Program crash
  PID:1796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4084 -s 328
  2⤵
  - Program crash
  PID:1628

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 4084 -ip 4084
1⤵
PID:4732

memory/4084-133-0x0000000068F40000-0x0000000068F86000-memory.dmp

Filesize
280KB

Download