3b1e84e9452c52f4448e38eed17b5c280b5fe4ec69b631e712ff65e60e26c3f1

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 18:56

Target

libXau-6.dll
Size

20KB
MD5

b6f0655bed934503621fcf94ba449a19
SHA1

f0a5d9eefff5f3bcd2e23b9db748c50cffc1c6e8
SHA256

0da1f856d92d6b95f10ed8c3f629cd15468c906de9352fb4ae629139d1412eed
SHA512

77a10ae1748e5d76288c59933f3f41d4dc7a690b1f2bc9bff0b761f9f2c5331f868dc0259ffe4c4672e1806c33f3f9d0fe0a8b09b10e06333d2590f623c5b284
SSDEEP

192:vdBaTJcGAV5S55Nv8ekSoifItD33VBBmBJI3b5Ud5kbQbDTHlNspsorvgAFa2jf7:lBwcGAV5S55ZkBpTVTuI3dUd5GFoCJg+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	4032	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4032	4460	rundll32.exe	87
PID 4460 wrote to memory of 4032	4460	rundll32.exe	87
PID 4460 wrote to memory of 4032	4460	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXau-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXau-6.dll,#1
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 564
    3⤵
    - Program crash
    PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4032 -ip 4032
1⤵
PID:3636