cd660bd4d4f7d33920a2c18be331041ba80d7770e1c47153a5dfae6da3f5e43e

Analysis

max time kernel
112s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15-06-2023 05:33

Target

Crafty-v1.1/runtimes/win-x86/native/libHarfBuzzSharp.dll
Size

786KB
MD5

34e122f4d80aa0ebea519b1ed077a98d
SHA1

d721d7354a3ec08f30ef7f9dd38c63dfc2381556
SHA256

dd8e415b762f0142665e91027e4d35566c49d67acf9bd037686e801a6b4aa3fb
SHA512

ff205e3c5fb3b4b754174cb127e8b44b41dc0ade4216096f255f9ff3d3467dc8f8531135a9c136e76b73f8b8e8768e0177edb731cc33714d7f545f8f5d10e877
SSDEEP

12288:72lp8F5nWQgS0bfzdkgxJR2zNffKOYpcGrFit8AnhV:72lp8FEb7FUhCbFitjD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4292 5016 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4292	5016	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5064 wrote to memory of 5016	5064	rundll32.exe	rundll32.exe
PID 5064 wrote to memory of 5016	5064	rundll32.exe	rundll32.exe
PID 5064 wrote to memory of 5016	5064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Crafty-v1.1\runtimes\win-x86\native\libHarfBuzzSharp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Crafty-v1.1\runtimes\win-x86\native\libHarfBuzzSharp.dll,#1
2⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 600
3⤵
- Program crash
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 5016
1⤵
PID:4648