b6ae0fe765ca7755b1496b3c74645daa54d3e9bda37c30c4afdcefdc298fa179

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 16:19

Target

EDGY/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
Size

598KB
MD5

400fa58643d66097feee1fd3955f0a5c
SHA1

06bf83186237c8bb0186f4e298823c3e50e74ff9
SHA256

c7bb58c8c6a74b7679ed20e85c6782a2bf4444d5e58d5d94a202e377b7db5669
SHA512

3842018ee1cf230d88021bcb2de7d8fd44cde38b6514010276086abc550d328147265e8c3d8c5a5f19b99fa59f5c30ae9e1dc1d710339d3d26d0886ac8483f0a
SSDEEP

12288:9UUtPcgVN+wdBbuMEiyvA5t3ggKTJmPV:jtEu75tBKTKV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1456	1820	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1820	3016	rundll32.exe	28
PID 3016 wrote to memory of 1820	3016	rundll32.exe	28
PID 3016 wrote to memory of 1820	3016	rundll32.exe	28
PID 3016 wrote to memory of 1820	3016	rundll32.exe	28
PID 3016 wrote to memory of 1820	3016	rundll32.exe	28
PID 3016 wrote to memory of 1820	3016	rundll32.exe	28
PID 3016 wrote to memory of 1820	3016	rundll32.exe	28
PID 1820 wrote to memory of 1456	1820	rundll32.exe	29
PID 1820 wrote to memory of 1456	1820	rundll32.exe	29
PID 1820 wrote to memory of 1456	1820	rundll32.exe	29
PID 1820 wrote to memory of 1456	1820	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EDGY\MonoBleedingEdge\EmbedRuntime\MonoPosixHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EDGY\MonoBleedingEdge\EmbedRuntime\MonoPosixHelper.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 220
    3⤵
    - Program crash
    PID:1456