7c0f72bad64237b4b2749840811299838e0062bd1551182ac82cae17a7e555bf

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 14:51

Target

refox/file/libxml2.dll
Size

1.4MB
MD5

cea056b5576621153af0887636e92934
SHA1

c4611a18ce995b84e0ffa618a3829cf4cd192117
SHA256

b1b3ad9622f5e59adaa883c248d7310d020f37eeb7f859fbc8699508266f9387
SHA512

a25ec56830a7743c06bef14767d4f9d4449cae0731d5e1babad76e674b6925688ebcf20aea7ed4879b8181de0f0db7fd30ac11c5c109e8770dbc77fa26b35f51
SSDEEP

24576:7ylsEVM3LO+bs4ofwTW+y0ywaJfVQf0llKuuGavkg3NyZHbbT+4IBAUZLYq:ux+9pauKlKuuGaXKy4IBAUZLYq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4588 64 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4588	64	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4264 wrote to memory of 64	4264	rundll32.exe	rundll32.exe
PID 4264 wrote to memory of 64	4264	rundll32.exe	rundll32.exe
PID 4264 wrote to memory of 64	4264	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\file\libxml2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\file\libxml2.dll,#1
  2⤵
  PID:64
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 608
    3⤵
    - Program crash
    PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 64 -ip 64
1⤵
PID:3520