e6376ab5246a8874a469b2e4c10d0325f3e664b55f90980e14e192a9e4c3c0a3

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 12:19

Target

cygwin1.dll
Size

1.2MB
MD5

704a37ecf297d83c92521d6b5972e93f
SHA1

12fbc47ce4ea836a9dcb743893a419f15c264bc1
SHA256

c0e27ae6a7b7106da5db889980a17fe55ea515ebfb3d4c03ce1e26d51bf9c73e
SHA512

64c19cc36b083061ada0aab2ed6fb8f49eb190f403592da7dcbd74100f90776c6091698df0415348b5deddfe3956e11159eb8d5afa5cb97cb1baa2050d40b6fd
SSDEEP

24576:wEwxAvt54cwaFWjVNEMUJHleueRhj0pUMITbOl8LgnS4fX/C+Xtf1mYPTRI:Ni4tCcwKw/tgH6Rhj0VibdLZ0/C+Xjmx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	4592	WerFault.exe	94

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin\mounts v2	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4740	4076	rundll32.exe	91
PID 4076 wrote to memory of 4740	4076	rundll32.exe	91
PID 4076 wrote to memory of 4740	4076	rundll32.exe	91
PID 4740 wrote to memory of 3048	4740	rundll32.exe	92
PID 4740 wrote to memory of 3048	4740	rundll32.exe	92
PID 4740 wrote to memory of 3048	4740	rundll32.exe	92
PID 3048 wrote to memory of 2016	3048	rundll32.exe	93
PID 3048 wrote to memory of 2016	3048	rundll32.exe	93
PID 3048 wrote to memory of 2016	3048	rundll32.exe	93
PID 2016 wrote to memory of 4592	2016	rundll32.exe	94
PID 2016 wrote to memory of 4592	2016	rundll32.exe	94
PID 2016 wrote to memory of 4592	2016	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cygwin1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cygwin1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cygwin1.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\cygwin1.dll,#1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\cygwin1.dll,#1
        5⤵
        Modifies data under HKEY_USERS
        
        PID:4592
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 736
        6⤵
        Program crash
        
        PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4592 -ip 4592
1⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4712

memory/3048-1-0x0000000061000000-0x0000000061259000-memory.dmp

Filesize
2.3MB

Download
memory/4592-2-0x0000000061000000-0x0000000061259000-memory.dmp

Filesize
2.3MB

Download
memory/4592-4-0x0000000061000000-0x0000000061259000-memory.dmp

Filesize
2.3MB

Download
memory/4740-0-0x0000000061000000-0x0000000061259000-memory.dmp

Filesize
2.3MB

Download
memory/4740-3-0x0000000061000000-0x0000000061259000-memory.dmp

Filesize
2.3MB

Download