b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f

Analysis

max time kernel
143s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 17:02

Target

libmpfr-4.dll
Size

421KB
MD5

8afb228e4f6458b6628a202d9de9edf8
SHA1

61f85589b4d5e1f7a8bb73b4851a66b59d07bce5
SHA256

5a72d472e892efd7d94ea287eda354637394805c2f445edec051b5c0a3d0f55b
SHA512

4e61d66f8c04087e0fdfb74a2e6cee7d97e75f9d0d21613af845b37e9ffb0f6511bf6d3bc264e646b7d89daa355520f1c49d8517cc7369c296c27c1340b1c16c
SSDEEP

3072:u9xaiHslmI/UkTPpUjei9LTgPp2Y3bJ+PngQ+t8KSWESqTrrTps0wed9Y8eFar6B:Yxai+7MY31KnPSleLQUhHy5z7s+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2488 2244 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2488	2244	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2868 wrote to memory of 2244	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2244	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2244	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2244	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2244	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2244	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2244	2868	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 2488	2244	rundll32.exe	WerFault.exe
PID 2244 wrote to memory of 2488	2244	rundll32.exe	WerFault.exe
PID 2244 wrote to memory of 2488	2244	rundll32.exe	WerFault.exe
PID 2244 wrote to memory of 2488	2244	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libmpfr-4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libmpfr-4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 228
3⤵
- Program crash
PID:2488

memory/2244-0-0x000000006F540000-0x000000006F59E000-memory.dmp

Filesize
376KB

Download
memory/2244-1-0x000000006ACC0000-0x000000006AD27000-memory.dmp

Filesize
412KB

Download