012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 19:52

Target

cgminer-3.7.2-blake/libcurl-4.dll
Size

603KB
MD5

67df7d44639b6d1e2c3ea5defd327f29
SHA1

3c65ff1dd12d44180681043bf2eeb30c3c442961
SHA256

a2c2bdce1b61089efb698856ff87a318106d51e9c434f7329aa412706b89660b
SHA512

25dafff594687a4edf6e38404a08a82db7172587405523c0379be2947b82ac5645591daa7cd8b59f8ba48b92b7d06c8e81bf0ce388be2ad44a7e9d9628e3d443
SSDEEP

12288:uzYrTU1m3UF1FS3g63rB7KXpMpklbxKhUr3tANvEIwY:uoTj3UF1FS3ld7KXpMpklbxKhs3CcDY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8	4572	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4572	3120	rundll32.exe	83
PID 3120 wrote to memory of 4572	3120	rundll32.exe	83
PID 3120 wrote to memory of 4572	3120	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libcurl-4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libcurl-4.dll,#1
  2⤵
  PID:4572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 648
    3⤵
    - Program crash
    PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4572 -ip 4572
1⤵
PID:4416

memory/4572-2-0x000000006E400000-0x000000006E45F000-memory.dmp

Filesize
380KB

Download
memory/4572-4-0x0000000063000000-0x00000000631A9000-memory.dmp

Filesize
1.7MB

Download
memory/4572-3-0x0000000062E80000-0x0000000062E9D000-memory.dmp

Filesize
116KB

Download
memory/4572-0-0x000000006B240000-0x000000006B2DE000-memory.dmp

Filesize
632KB

Download