e7bf5558d5445eb2f7e3d0cd4001a54281293f98230b23522f6d444afa4bc9eb

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 23:29

Target
libXdmcp-6.dll
Size 28KB
Sample240227-3gywfaeb44
SHA256 7705851ba047a8154402aca92621b60be0e0e9d9b52b19bf8be540305bd53dba
MD5 7d4f4d3bc6ab6c3ea2097a7ecd018728
SHA1 2434fbad089ac85eda43c0b0e911ab437b4dfe63
SHA512 f9b64cbcd7c7c7b4e942c3da74fb280762d038f974fc23d1e0431b15787aefc87464cda121aa8fccf499af46e345dd65aa5fb5cfee1cb45dba6e5dd79b01a1d8
SSDEEP 384:sEZJxxKcB6SOd08J0DBljbG4H80iIOitbr0iIOi1Nk6qTdOoTcFbf3IU2xRov+h2:sEYWnJH80Qi0Q+ZOcFDR27e
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4508	2756	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2756	816	rundll32.exe	86
PID 816 wrote to memory of 2756	816	rundll32.exe	86
PID 816 wrote to memory of 2756	816	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXdmcp-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXdmcp-6.dll,#1
  2⤵
  PID:2756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 632
    3⤵
    - Program crash
    PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2756 -ip 2756
1⤵
PID:4192

memory/2756-0-0x000000006DBC0000-0x000000006DBCF000-memory.dmp

Download

memory/2756-2-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download

memory/2756-1-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download