012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:52

Target

cgminer-3.7.2-blake/libusb-1.0.dll
Size

406KB
MD5

d4e9f84d0725c38e4bdbe20d02f53868
SHA1

c96c8331c528c4d109f307da82bdd86808f3021a
SHA256

7390937f9fc024cc855f334131d5180c94b70b1bc810384ba72ac821b113490a
SHA512

42ef0f3d6167523ab8bd369d4f6d67bd29438ffefe2f6da3a8a4765c73aedda22f48999452a54334c87d8b56abe28a53fc10cb80de7392d77016c966d98f79dc
SSDEEP

6144:WPRwPbkw+fmPqEXqDzjL8Lkm+IAm2t/vOBkArbAcn13I2iV:WJwz3+fSq7P8qIqQ192V

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1964 2992 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1964	2992	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2420 wrote to memory of 2992	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 2992	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 2992	2420	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libusb-1.0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libusb-1.0.dll,#1
2⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 608
3⤵
- Program crash
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2992 -ip 2992
1⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4456

memory/2992-1-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/2992-0-0x000000006B600000-0x000000006B668000-memory.dmp

Filesize
416KB

Download