012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:52

Target

cgminer-3.7.2-blake/libgcc_s_dw2-1.dll
Size

116KB
MD5

000abdf5d3e31514801b44b954e1cf91
SHA1

89ebff9d7806e8550adde0ce111733909a205a5d
SHA256

63843b68b9887080c6d6abe74abd4382312c2082d92b5f527ba13fd90ea5c956
SHA512

f4df32699b9923a1fdc823d281228e807cce0367c4a8a7b30b99a2278bc04b9f0b483a5f24a0f5526b95b71cee9f29b50c7fbf7afd412267fe02b6f58770bf5b
SSDEEP

3072:ou768hn2xXOjzXa6VhSlmBuqwNKvp7Ag9MSspV:H766sXOjzV+lmBZwNKvp7AwM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

312 2280 WerFault.exe rundll32.exe

pid	pid_target	process	target process
312	2280	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 312	2280	rundll32.exe	WerFault.exe
PID 2280 wrote to memory of 312	2280	rundll32.exe	WerFault.exe
PID 2280 wrote to memory of 312	2280	rundll32.exe	WerFault.exe
PID 2280 wrote to memory of 312	2280	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libgcc_s_dw2-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libgcc_s_dw2-1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 228
3⤵
- Program crash
PID:312

memory/2280-0-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download