012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0

Analysis

max time kernel
130s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:52

Target

cgminer-3.7.2-blake/libgcc_s_dw2-1.dll
Size

116KB
MD5

000abdf5d3e31514801b44b954e1cf91
SHA1

89ebff9d7806e8550adde0ce111733909a205a5d
SHA256

63843b68b9887080c6d6abe74abd4382312c2082d92b5f527ba13fd90ea5c956
SHA512

f4df32699b9923a1fdc823d281228e807cce0367c4a8a7b30b99a2278bc04b9f0b483a5f24a0f5526b95b71cee9f29b50c7fbf7afd412267fe02b6f58770bf5b
SSDEEP

3072:ou768hn2xXOjzXa6VhSlmBuqwNKvp7Ag9MSspV:H766sXOjzV+lmBZwNKvp7AwM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4788 640 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4788	640	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1020 wrote to memory of 640	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 640	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 640	1020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libgcc_s_dw2-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libgcc_s_dw2-1.dll,#1
2⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 604
3⤵
- Program crash
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 640 -ip 640
1⤵
PID:576

memory/640-0-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download