288492de5197a9fa987cb4bc2463a93c5653e07a8bb0dc1d6bb31d620a26ecc4

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 21:30

Target

libusb-1.0.dll
Size

256KB
MD5

90a50cf50e4e3556ff1b53aefc8a06fb
SHA1

be2ebb90ccb025fee7d6d380c5ab984253a94810
SHA256

0760140d425269244c20bc4fb55f495598ab2b0e9db1584b28295799b18d90ef
SHA512

6f17c0ac722508f07cd8677362b1c8b6cfcba9713dae858a488e0d90e039e74d2d5fefead416ddcba23f26298e4ec069243e381e220f38f30cfbba9495a12cea
SSDEEP

3072:9JvlmaUCl73ao0rsF/xQ7z2EJbNfNJJcP3yc8o1B9nMnnIRFOE7KBT+rwJ:9BlNll7qo0rsF/u7zJlXch84BBSEeJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2912	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2912 wrote to memory of 2928	2912	rundll32.exe	29
PID 2912 wrote to memory of 2928	2912	rundll32.exe	29
PID 2912 wrote to memory of 2928	2912	rundll32.exe	29
PID 2912 wrote to memory of 2928	2912	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libusb-1.0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libusb-1.0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 224
    3⤵
    - Program crash
    PID:2928

memory/2912-0-0x000000006B800000-0x000000006B83C000-memory.dmp

Filesize
240KB

Download