b4873ade58e22893042b36bdd7c1a3316364b6ddf52952117b0975f5237cb9cd

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 13:10

Target
libXdmcp-6.dll
Size 28KB
Sample240224-qephrsdc7v
SHA256 7705851ba047a8154402aca92621b60be0e0e9d9b52b19bf8be540305bd53dba
MD5 7d4f4d3bc6ab6c3ea2097a7ecd018728
SHA1 2434fbad089ac85eda43c0b0e911ab437b4dfe63
SHA512 f9b64cbcd7c7c7b4e942c3da74fb280762d038f974fc23d1e0431b15787aefc87464cda121aa8fccf499af46e345dd65aa5fb5cfee1cb45dba6e5dd79b01a1d8
SSDEEP 384:sEZJxxKcB6SOd08J0DBljbG4H80iIOitbr0iIOi1Nk6qTdOoTcFbf3IU2xRov+h2:sEYWnJH80Qi0Q+ZOcFDR27e
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4224	4564	WerFault.exe	45

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4564	3208	rundll32.exe	45
PID 3208 wrote to memory of 4564	3208	rundll32.exe	45
PID 3208 wrote to memory of 4564	3208	rundll32.exe	45

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXdmcp-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXdmcp-6.dll,#1
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 568
    3⤵
    - Program crash
    PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4564 -ip 4564
1⤵
PID:4192