6a5a2791cda73a54076004dae6ddbfc4d8708dbbf6dbc21008bd02baa5dcc22b

Analysis

max time kernel
144s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2023 15:43

Target

120-MYSQL-V999/RX-120-MYSQL-V999/libmysql.dll
Size

1.5MB
MD5

e169981c4ea5d7a18d56631bf6801cf1
SHA1

6186672dbd42aa0010de0b4ae0db4cc0cc2ae829
SHA256

6b7c023cc1c4925a70914a09d9f83d9301826739dfdd0303d5e745803b4eed5c
SHA512

575756bfa393f64546b69b8230eb3ad2d2ce3dbaf6661cc525d0eecf31605179270946b4a5fad16fc953d2bc3c054bbe539a996aeb32dc37a1cf9442574118d9
SSDEEP

24576:cVbxTa5amfbLxFFLHKAayv2FTG6NW9T9PnGflFfY8KkmRNGavf8:kbxTa5LbLxFFLHUyO4T9vGfHvHmRJX8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	3524	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 3524	548	rundll32.exe	83
PID 548 wrote to memory of 3524	548	rundll32.exe	83
PID 548 wrote to memory of 3524	548	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\120-MYSQL-V999\RX-120-MYSQL-V999\libmysql.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\120-MYSQL-V999\RX-120-MYSQL-V999\libmysql.dll,#1
  2⤵
  PID:3524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 656
    3⤵
    - Program crash
    PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3524 -ip 3524
1⤵
PID:1652