b6ae0fe765ca7755b1496b3c74645daa54d3e9bda37c30c4afdcefdc298fa179

Analysis

max time kernel
134s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 16:19

Target

EDGY/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
Size

598KB
MD5

400fa58643d66097feee1fd3955f0a5c
SHA1

06bf83186237c8bb0186f4e298823c3e50e74ff9
SHA256

c7bb58c8c6a74b7679ed20e85c6782a2bf4444d5e58d5d94a202e377b7db5669
SHA512

3842018ee1cf230d88021bcb2de7d8fd44cde38b6514010276086abc550d328147265e8c3d8c5a5f19b99fa59f5c30ae9e1dc1d710339d3d26d0886ac8483f0a
SSDEEP

12288:9UUtPcgVN+wdBbuMEiyvA5t3ggKTJmPV:jtEu75tBKTKV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	3084	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 3084	2656	rundll32.exe	85
PID 2656 wrote to memory of 3084	2656	rundll32.exe	85
PID 2656 wrote to memory of 3084	2656	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EDGY\MonoBleedingEdge\EmbedRuntime\MonoPosixHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EDGY\MonoBleedingEdge\EmbedRuntime\MonoPosixHelper.dll,#1
  2⤵
  PID:3084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 600
    3⤵
    - Program crash
    PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3084 -ip 3084
1⤵
PID:1232