4aab20889fea1250ebff86fd28bebdaa19cc310c496bcddcfdf2d3db56387a3c

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 15:17

Target

resources/app.asar.unpacked/node_modules/leveldown/prebuilds/win32-ia32/node.napi.dll
Size

405KB
MD5

ec76f517cbf09f1d642a30ad97ebc7c4
SHA1

863b02b912130de5dde04f0eca76ff3867c9eb82
SHA256

16a0f74da89fd1c98027627a82b63173e6e7b53dc9ecaee5d325095f353f198f
SHA512

ce8f9bc2795d1325622da5bbb76bd369359400f4ed5cbdbd941754f131d36ccb996966f27fab2d481440473c6b7f53c41d6c005a7d3a466f1e8a3157d1a55d29
SSDEEP

12288:XL1JZBGB9E30od2pCXLPOV5o8srWkdhgOCeG:XLPLGBq7jLPOV5oThguG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2996 2960 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2996	2960	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1528 wrote to memory of 2960	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 2960	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 2960	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 2960	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 2960	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 2960	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 2960	1528	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2996	2960	rundll32.exe	WerFault.exe
PID 2960 wrote to memory of 2996	2960	rundll32.exe	WerFault.exe
PID 2960 wrote to memory of 2996	2960	rundll32.exe	WerFault.exe
PID 2960 wrote to memory of 2996	2960	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\win32-ia32\node.napi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\win32-ia32\node.napi.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 268
3⤵
- Program crash
PID:2996