012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:52

Target

cgminer-3.7.2-blake/zlib1.dll
Size

83KB
MD5

2ba480963e75356236d10adbb71454c4
SHA1

186dc42ac852038eb04d7a700ceec88b4780a3b1
SHA256

7c758b22a3d8781ac8cabda663810ccd7da4303a7a9edf28c1a62d07c4ffed94
SHA512

1738525134caf365adccccdea2afc77bd0eb2330c74d1c475fe6f6b3b6468196b8610ee07846be37938065941e368aa747387af70e7293c4101bba2f4bc58b46
SSDEEP

1536:/cFEQPpdcntPt7hmOA/SJ0vkFvmyWgP04eSJJynToIfEIOjIOlsl+:/tQxdcntPt7hmOA/SJ0vum4VJJ+TBfqY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3424 448 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3424	448	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4752 wrote to memory of 448	4752	rundll32.exe	rundll32.exe
PID 4752 wrote to memory of 448	4752	rundll32.exe	rundll32.exe
PID 4752 wrote to memory of 448	4752	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\zlib1.dll,#1
2⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 600
3⤵
- Program crash
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 448 -ip 448
1⤵
PID:3964

memory/448-0-0x0000000062E80000-0x0000000062E9D000-memory.dmp

Filesize
116KB

Download