012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 19:52

Target

cgminer-3.7.2-blake/zlib1.dll
Size

83KB
MD5

2ba480963e75356236d10adbb71454c4
SHA1

186dc42ac852038eb04d7a700ceec88b4780a3b1
SHA256

7c758b22a3d8781ac8cabda663810ccd7da4303a7a9edf28c1a62d07c4ffed94
SHA512

1738525134caf365adccccdea2afc77bd0eb2330c74d1c475fe6f6b3b6468196b8610ee07846be37938065941e368aa747387af70e7293c4101bba2f4bc58b46
SSDEEP

1536:/cFEQPpdcntPt7hmOA/SJ0vkFvmyWgP04eSJJynToIfEIOjIOlsl+:/tQxdcntPt7hmOA/SJ0vum4VJJ+TBfqY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3424	448	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 448	4752	rundll32.exe	83
PID 4752 wrote to memory of 448	4752	rundll32.exe	83
PID 4752 wrote to memory of 448	4752	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\zlib1.dll,#1
  2⤵
  PID:448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 600
    3⤵
    - Program crash
    PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 448 -ip 448
1⤵
PID:3964

memory/448-0-0x0000000062E80000-0x0000000062E9D000-memory.dmp

Filesize
116KB

Download