288492de5197a9fa987cb4bc2463a93c5653e07a8bb0dc1d6bb31d620a26ecc4

Analysis

max time kernel
51s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 21:30

Target

libusb-1.0.dll
Size

256KB
MD5

90a50cf50e4e3556ff1b53aefc8a06fb
SHA1

be2ebb90ccb025fee7d6d380c5ab984253a94810
SHA256

0760140d425269244c20bc4fb55f495598ab2b0e9db1584b28295799b18d90ef
SHA512

6f17c0ac722508f07cd8677362b1c8b6cfcba9713dae858a488e0d90e039e74d2d5fefead416ddcba23f26298e4ec069243e381e220f38f30cfbba9495a12cea
SSDEEP

3072:9JvlmaUCl73ao0rsF/xQ7z2EJbNfNJJcP3yc8o1B9nMnnIRFOE7KBT+rwJ:9BlNll7qo0rsF/u7zJlXch84BBSEeJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	4924	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4924	116	rundll32.exe	82
PID 116 wrote to memory of 4924	116	rundll32.exe	82
PID 116 wrote to memory of 4924	116	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libusb-1.0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libusb-1.0.dll,#1
  2⤵
  PID:4924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 600
    3⤵
    - Program crash
    PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4924 -ip 4924
1⤵
PID:4772

memory/4924-0-0x000000006B800000-0x000000006B83C000-memory.dmp

Filesize
240KB

Download