081b2455cbf464eee43082d023137137eaf43b7a6e1f475feeb75b7cdaaa4cac

Analysis

max time kernel
121s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 01:02

Target

Sora - OpenAi v1.1/__MACOSX/libssh2.dll
Size

163KB
MD5

73f95c1b2a23be7a80aa75250b8f25ad
SHA1

20dcce600d126479bd2f0226ae4b8981ee1f147b
SHA256

ed0db696c2ae8b896eab6fd8c71e5fa4c88e6a90b98fffc354593288d59fe119
SHA512

5ee88e0b0215dc7c970e085068f24baf3d7d1df247e7ed56d052dfa20d7dfd603353f036daa0d60e1514277e27d49449fbd9708a5e1c690eb1b90699e7f0e42f
SSDEEP

3072:n0GqDrIKZruzzO3K0n/fpti2qZhZNTBf5s5G/3:n0kKNufE/fpti2qZhZNTBRsQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4872	4620	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4620	4588	rundll32.exe	93
PID 4588 wrote to memory of 4620	4588	rundll32.exe	93
PID 4588 wrote to memory of 4620	4588	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\libssh2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\libssh2.dll",#1
  2⤵
  PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 632
    3⤵
    - Program crash
    PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4620 -ip 4620
1⤵
PID:4116