c946192bf47377d97cc4aff9cc4e405acbd19aae30a1745be4b7fa7f230ad8c0

Analysis

max time kernel
172s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 01:21

Target

publish/bin/libfontconfig-1.dll
Size

288KB
MD5

efe9a5ff9d1d6a8cdcb8670d98791b81
SHA1

a0daffc09bb58df32478b69bbc2ceca709d52a70
SHA256

34b4d2804dd5e3e46b6592b9d4e875afca50652f487733545257817b25416f31
SHA512

a3b92c630d95aff0b734b287a04e0b0310c63136100171bb0146f1941d5fe6181d25a084686e7419bbb2e7c08e65fc9e8b4ca0e9a833c35aba2aaf80f40b8b6b
SSDEEP

6144:Y8eYpWtiDDGoO2NKdp9yFArsHGn7Zx1MbF84/:xdWMDDFO2MdpoFAFn7X1MbF84/

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3736 1216 WerFault.exe rundll32.exe
3616 1216 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3736	1216	WerFault.exe	rundll32.exe
3616	1216	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1216 wrote to memory of 3736	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 3736	1216	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libfontconfig-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1216 -s 448
  2⤵
  - Program crash
  PID:3736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1216 -s 448
  2⤵
  - Program crash
  PID:3616

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 1216 -ip 1216
1⤵
PID:4692

memory/1216-133-0x0000000064F80000-0x0000000064FCE000-memory.dmp

Filesize
312KB

Download
memory/1216-134-0x00000000693C0000-0x0000000069473000-memory.dmp

Filesize
716KB

Download
memory/1216-135-0x0000000066000000-0x000000006610B000-memory.dmp

Filesize
1.0MB

Download
memory/1216-136-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

Filesize
160KB

Download
memory/1216-137-0x0000000068F40000-0x0000000068F86000-memory.dmp

Filesize
280KB

Download
memory/1216-139-0x00000000626C0000-0x00000000626DA000-memory.dmp

Filesize
104KB

Download
memory/1216-138-0x0000000061600000-0x0000000061712000-memory.dmp

Filesize
1.1MB

Download
memory/1216-140-0x0000000068B40000-0x0000000068B80000-memory.dmp

Filesize
256KB

Download
memory/1216-141-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download
memory/1216-142-0x0000000061440000-0x000000006145C000-memory.dmp

Filesize
112KB

Download
memory/1216-143-0x00000000649C0000-0x0000000064AE5000-memory.dmp

Filesize
1.1MB

Download
memory/1216-144-0x0000000070540000-0x000000007056D000-memory.dmp

Filesize
180KB

Download
memory/1216-145-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/1216-146-0x000000006FC40000-0x000000006FDA5000-memory.dmp

Filesize
1.4MB

Download
memory/1216-147-0x0000000069140000-0x000000006918E000-memory.dmp

Filesize
312KB

Download