012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:52

Target

cgminer-3.7.2-blake/libcurl-4.dll
Size

603KB
MD5

67df7d44639b6d1e2c3ea5defd327f29
SHA1

3c65ff1dd12d44180681043bf2eeb30c3c442961
SHA256

a2c2bdce1b61089efb698856ff87a318106d51e9c434f7329aa412706b89660b
SHA512

25dafff594687a4edf6e38404a08a82db7172587405523c0379be2947b82ac5645591daa7cd8b59f8ba48b92b7d06c8e81bf0ce388be2ad44a7e9d9628e3d443
SSDEEP

12288:uzYrTU1m3UF1FS3g63rB7KXpMpklbxKhUr3tANvEIwY:uoTj3UF1FS3ld7KXpMpklbxKhs3CcDY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1380 1692 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1380	1692	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1220 wrote to memory of 1692	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1692	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1692	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1692	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1692	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1692	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1692	1220	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1380	1692	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libcurl-4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libcurl-4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 240
3⤵
- Program crash
PID:1380

memory/1692-0-0x000000006B240000-0x000000006B2DE000-memory.dmp

Filesize
632KB

Download
memory/1692-2-0x0000000063000000-0x00000000631A9000-memory.dmp

Filesize
1.7MB

Download
memory/1692-4-0x0000000062E80000-0x0000000062E9D000-memory.dmp

Filesize
116KB

Download
memory/1692-3-0x000000006E400000-0x000000006E45F000-memory.dmp

Filesize
380KB

Download