b4873ade58e22893042b36bdd7c1a3316364b6ddf52952117b0975f5237cb9cd

Analysis

max time kernel
93s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 13:10

Target
libxcb-image-0.dll
Size 25KB
Sample240224-qephrsdc7v
SHA256 cb220267fb0116b298bab6a09a764420d630c52026f7d750f8ffca4818389327
MD5 a3718d24f0e6eae9d6121a1219381ae9
SHA1 a3377f64d8fb6162f6280d3d924626c1fc6a2fe7
SHA512 43f9c760be222490d43cbd9589b4afbc64759919993a1957a13a753cfcc9d94059dba0b5400a745c377c7bea1f02f4f8f6f952bee5b7ed33f6a49efaec62e9f6
SSDEEP 384:MQg1oL5xGT8So2/8iC6KcIId6dTGtDVHJsH9I8qxeHt6Lboi7:1g4i8i5EdTUpGdrBMLV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3408	4596	WerFault.exe	68

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 4596	3600	rundll32.exe	68
PID 3600 wrote to memory of 4596	3600	rundll32.exe	68
PID 3600 wrote to memory of 4596	3600	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libxcb-image-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libxcb-image-0.dll,#1
  2⤵
  PID:4596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 560
    3⤵
    - Program crash
    PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4596 -ip 4596
1⤵
PID:2708