7d93356ce79e5c931bc2951c4284d42fc9210c8e130ffec7833463f3d7aaaa75

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 12:28

Target

$INSTDIR"/bin/"/libxml2.dll
Size

625KB
MD5

37d9bf74558c5c4e7cd82e3d94ebb665
SHA1

3d07dbe217f0ded73be5614c6774621a5c9080a7
SHA256

8ed6747212836618800fff123d46759e864cf7369daf175c3e6d7a8a8c4e9b72
SHA512

b0a2e430c7211921a68568ac19d5702acbf8e6aaf0d51dfb767d7f3c3939541d63bf771d6af15cd9e93436b52c5d83bad6ad3d18865f82dd1acbd589121fb271
SSDEEP

12288:Rc2Y6o+rHr+Bd/uEfeffjd5Jc4RdhYRY+G:RnY6o+rHr+/uEfA5h73H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	1736	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1736	2040	rundll32.exe	28
PID 2040 wrote to memory of 1736	2040	rundll32.exe	28
PID 2040 wrote to memory of 1736	2040	rundll32.exe	28
PID 2040 wrote to memory of 1736	2040	rundll32.exe	28
PID 2040 wrote to memory of 1736	2040	rundll32.exe	28
PID 2040 wrote to memory of 1736	2040	rundll32.exe	28
PID 2040 wrote to memory of 1736	2040	rundll32.exe	28
PID 1736 wrote to memory of 1792	1736	rundll32.exe	29
PID 1736 wrote to memory of 1792	1736	rundll32.exe	29
PID 1736 wrote to memory of 1792	1736	rundll32.exe	29
PID 1736 wrote to memory of 1792	1736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$INSTDIR_\bin\_\libxml2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$INSTDIR_\bin\_\libxml2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 224
    3⤵
    - Program crash
    PID:1792

memory/1736-0-0x000000006E5C0000-0x000000006E64A000-memory.dmp

Filesize
552KB

Download