e6376ab5246a8874a469b2e4c10d0325f3e664b55f90980e14e192a9e4c3c0a3

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 12:19

Target

cygwin1.dll
Size

1.2MB
MD5

704a37ecf297d83c92521d6b5972e93f
SHA1

12fbc47ce4ea836a9dcb743893a419f15c264bc1
SHA256

c0e27ae6a7b7106da5db889980a17fe55ea515ebfb3d4c03ce1e26d51bf9c73e
SHA512

64c19cc36b083061ada0aab2ed6fb8f49eb190f403592da7dcbd74100f90776c6091698df0415348b5deddfe3956e11159eb8d5afa5cb97cb1baa2050d40b6fd
SSDEEP

24576:wEwxAvt54cwaFWjVNEMUJHleueRhj0pUMITbOl8LgnS4fX/C+Xtf1mYPTRI:Ni4tCcwKw/tgH6Rhj0VibdLZ0/C+Xjmx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2020	1164	WerFault.exe	28

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions\Cygwin	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions\Cygwin\mounts v2	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1164	112	rundll32.exe	28
PID 112 wrote to memory of 1164	112	rundll32.exe	28
PID 112 wrote to memory of 1164	112	rundll32.exe	28
PID 112 wrote to memory of 1164	112	rundll32.exe	28
PID 112 wrote to memory of 1164	112	rundll32.exe	28
PID 112 wrote to memory of 1164	112	rundll32.exe	28
PID 112 wrote to memory of 1164	112	rundll32.exe	28
PID 1164 wrote to memory of 2020	1164	rundll32.exe	29
PID 1164 wrote to memory of 2020	1164	rundll32.exe	29
PID 1164 wrote to memory of 2020	1164	rundll32.exe	29
PID 1164 wrote to memory of 2020	1164	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cygwin1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cygwin1.dll,#1
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 336
    3⤵
    - Program crash
    PID:2020

memory/1164-0-0x0000000061000000-0x0000000061259000-memory.dmp

Filesize
2.3MB

Download