d45f541b13139346d518b1ab79a5f70dda19ab6359327d7b76ab91a459813754

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-03-2024 18:36

Target

runtimes/win-x64/lib/netcoreapp3.0/CefSharp.BrowserSubprocess.Core.dll
Size

1.2MB
MD5

0695056020eb63f62877493e58cb34a4
SHA1

9c8135dc406cd42f2ceebec947c8113238e4fc78
SHA256

cd125611cdb5f3a74ee952951a692ee598daa5a7491e87676a4f68930117bb2a
SHA512

6a74c029cb1f9b96780d207710b00c9430c629174e08c462c5d8db4ae766946dcb464c7b0ec00cf9db947a873f9c8c5338ed02342ce053397cb533c5808dd236
SSDEEP

24576:2SmUYbNCuAzZ0vgnBoXoiYbhQspQ8SdWHubiWycQrQK0OXPwtibTL3:fabRAzZ0vgnBoXoiYbhQspQ8SdWHubiT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 944 wrote to memory of 1724	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 1724	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 1724	944	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\runtimes\win-x64\lib\netcoreapp3.0\CefSharp.BrowserSubprocess.Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 944 -s 756
2⤵
PID:1724

memory/944-0-0x0000000001FA0000-0x000000000221A000-memory.dmp

Filesize
2.5MB

Download
memory/944-1-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/944-2-0x000000001B650000-0x000000001B788000-memory.dmp

Filesize
1.2MB

Download
memory/944-3-0x000007FEF4B40000-0x000007FEF552C000-memory.dmp

Filesize
9.9MB

Download
memory/944-4-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/944-5-0x000007FEF4B40000-0x000007FEF552C000-memory.dmp

Filesize
9.9MB

Download