ba2f2e8f23015035d16be8378c5e30d42b8a6419dae1a9f50ddb0a358175a159

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 13:40

Target

App/ProgramFiles/libcroco-0.6-3.dll
Size

251KB
MD5

040c60cbb07a7ebb3eae2d427831fca9
SHA1

70e7b92502111906d349eada98499be79bd68f24
SHA256

f272b7d87ab27daf7eddb0a47cbac1d041da3010f0c8264bb2930b4f5a7a015e
SHA512

a090a6b8947b656cfd180b74041a4566c9ab378f84409fa28ccbcf929a73e31cc00dbe4bfb2424c0d3a56089e1df3ac2d6789befda94e9e9067905444574d437
SSDEEP

6144:uAflFDI+soXMd6PMSFnevY/F02F7DiTHh4C:lFDIwn0mU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	2688	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2688	2356	rundll32.exe	30
PID 2356 wrote to memory of 2688	2356	rundll32.exe	30
PID 2356 wrote to memory of 2688	2356	rundll32.exe	30
PID 2356 wrote to memory of 2688	2356	rundll32.exe	30
PID 2356 wrote to memory of 2688	2356	rundll32.exe	30
PID 2356 wrote to memory of 2688	2356	rundll32.exe	30
PID 2356 wrote to memory of 2688	2356	rundll32.exe	30
PID 2688 wrote to memory of 2724	2688	rundll32.exe	31
PID 2688 wrote to memory of 2724	2688	rundll32.exe	31
PID 2688 wrote to memory of 2724	2688	rundll32.exe	31
PID 2688 wrote to memory of 2724	2688	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\libcroco-0.6-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\libcroco-0.6-3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 224
    3⤵
    - Program crash
    PID:2724

memory/2688-0-0x0000000066440000-0x0000000066475000-memory.dmp

Filesize
212KB

Download
memory/2688-4-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download
memory/2688-2-0x000000006A300000-0x000000006A323000-memory.dmp

Filesize
140KB

Download
memory/2688-1-0x00000000685C0000-0x00000000686C6000-memory.dmp

Filesize
1.0MB

Download
memory/2688-3-0x0000000068080000-0x0000000068174000-memory.dmp

Filesize
976KB

Download