b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2024 17:02

Target

libmpfr-4.dll
Size

421KB
MD5

8afb228e4f6458b6628a202d9de9edf8
SHA1

61f85589b4d5e1f7a8bb73b4851a66b59d07bce5
SHA256

5a72d472e892efd7d94ea287eda354637394805c2f445edec051b5c0a3d0f55b
SHA512

4e61d66f8c04087e0fdfb74a2e6cee7d97e75f9d0d21613af845b37e9ffb0f6511bf6d3bc264e646b7d89daa355520f1c49d8517cc7369c296c27c1340b1c16c
SSDEEP

3072:u9xaiHslmI/UkTPpUjei9LTgPp2Y3bJ+PngQ+t8KSWESqTrrTps0wed9Y8eFar6B:Yxai+7MY31KnPSleLQUhHy5z7s+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3960 2764 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3960	2764	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3964 wrote to memory of 2764	3964	rundll32.exe	rundll32.exe
PID 3964 wrote to memory of 2764	3964	rundll32.exe	rundll32.exe
PID 3964 wrote to memory of 2764	3964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libmpfr-4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libmpfr-4.dll,#1
2⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 604
3⤵
- Program crash
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2764 -ip 2764
1⤵
PID:872

memory/2764-0-0x000000006F540000-0x000000006F59E000-memory.dmp

Filesize
376KB

Download
memory/2764-1-0x000000006ACC0000-0x000000006AD27000-memory.dmp

Filesize
412KB

Download