ba2f2e8f23015035d16be8378c5e30d42b8a6419dae1a9f50ddb0a358175a159

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 13:40

Target

App/ProgramFiles/libglib-2.0-0.dll
Size

1.2MB
MD5

87e289b194a98b66779d6f045386baf6
SHA1

5a66e4ae1d29d32f41ab101849df70f2432b2b15
SHA256

2b2567a2393860951cab5d3566f7d27c2c92a84c970abdeefd94c6a342c29472
SHA512

8ca3e07d81ce5709eab951187755abd3753e121cb3439b959f4ea058ae6f9a78fb45c8f63647e5984a943f8e553f0fd042983eacdcadbdc6c4c8cc2ec3a6a092
SSDEEP

24576:pqjKRb1Ih0KXMgUuJwEZFYzsPH4Az66d6ddM5d0Hlp4VmIkm54k4+v6S:p4iUNMgUawUYzQW6sddM5d0F6Vmiyy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2928	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2928	2728	rundll32.exe	30
PID 2728 wrote to memory of 2928	2728	rundll32.exe	30
PID 2728 wrote to memory of 2928	2728	rundll32.exe	30
PID 2728 wrote to memory of 2928	2728	rundll32.exe	30
PID 2728 wrote to memory of 2928	2728	rundll32.exe	30
PID 2728 wrote to memory of 2928	2728	rundll32.exe	30
PID 2728 wrote to memory of 2928	2728	rundll32.exe	30
PID 2928 wrote to memory of 2784	2928	rundll32.exe	31
PID 2928 wrote to memory of 2784	2928	rundll32.exe	31
PID 2928 wrote to memory of 2784	2928	rundll32.exe	31
PID 2928 wrote to memory of 2784	2928	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\libglib-2.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\libglib-2.0-0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 224
    3⤵
    - Program crash
    PID:2784

memory/2928-1-0x000000006A300000-0x000000006A323000-memory.dmp

Filesize
140KB

Download
memory/2928-0-0x00000000685C0000-0x00000000686C6000-memory.dmp

Filesize
1.0MB

Download