fe58493f156a33a70e4bb6e1806f4d52ab687d8fe07ba688acaa18f75dcd16e2

Analysis

max time kernel
23s
max time network
35s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 12:08

Target

Components/CefSharp.Core.Runtime.dll
Size

1.9MB
MD5

a463cb9331efeb1c4c8fa390a09f214b
SHA1

766fb07934eceb4f3787729e534fa341cc323c09
SHA256

1e2f4da5d5be9b86f7d3a52dac608f8ed78a76216fd5e2bc6852953a3069e694
SHA512

c8d406d2c30391c10d355a62d0cbcbffb67922caa5646ea3fab2ce59658cf4646ff701038581cf940b8d66e786e3b9cfa1c895e4c6f37ec58039dcdfb37895ac
SSDEEP

49152:XirlFrK8ko4jqcfUhPolDexla9e6dhkOiqnKA++e6P4ZcVQm6U5srQK0O3kQ62gQ:XI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	3064	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2224	3064	rundll32.exe	28
PID 3064 wrote to memory of 2224	3064	rundll32.exe	28
PID 3064 wrote to memory of 2224	3064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Components\CefSharp.Core.Runtime.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3064 -s 772
  2⤵
  - Program crash
  PID:2224

memory/3064-54-0x000000001B190000-0x000000001B377000-memory.dmp

Filesize
1.9MB

Download
memory/3064-55-0x00000000022F0000-0x0000000002370000-memory.dmp

Filesize
512KB

Download
memory/3064-56-0x00000000022F0000-0x0000000002370000-memory.dmp

Filesize
512KB

Download