012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0

Analysis

max time kernel
143s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:52

Target

cgminer-3.7.2-blake/libusb-1.0.dll
Size

406KB
MD5

d4e9f84d0725c38e4bdbe20d02f53868
SHA1

c96c8331c528c4d109f307da82bdd86808f3021a
SHA256

7390937f9fc024cc855f334131d5180c94b70b1bc810384ba72ac821b113490a
SHA512

42ef0f3d6167523ab8bd369d4f6d67bd29438ffefe2f6da3a8a4765c73aedda22f48999452a54334c87d8b56abe28a53fc10cb80de7392d77016c966d98f79dc
SSDEEP

6144:WPRwPbkw+fmPqEXqDzjL8Lkm+IAm2t/vOBkArbAcn13I2iV:WJwz3+fSq7P8qIqQ192V

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2016 1952 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2016	1952	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1336 wrote to memory of 1952	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1952	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1952	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1952	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1952	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1952	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1952	1336	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 2016	1952	rundll32.exe	WerFault.exe
PID 1952 wrote to memory of 2016	1952	rundll32.exe	WerFault.exe
PID 1952 wrote to memory of 2016	1952	rundll32.exe	WerFault.exe
PID 1952 wrote to memory of 2016	1952	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libusb-1.0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libusb-1.0.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 232
3⤵
- Program crash
PID:2016

memory/1952-1-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/1952-0-0x000000006B600000-0x000000006B668000-memory.dmp

Filesize
416KB

Download