06a6bf60e15ae575c2184bbd1d32d3ddcfb180cf144964fdd4440d5db8797879

Analysis

max time kernel
24s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13/02/2023, 04:23

Target

crunchunity.dll
Size

30KB
MD5

3adba526ae38591d5c7f880d1602ed0b
SHA1

52529a1679272a693d09622027e57623d6b6dcd0
SHA256

a23f2e66d83551795c941ca36086260a9b3b61d205779faf5f4f949a00393b41
SHA512

f60595f5a9703908b7af4349818c6d47ba6b70f2078561ae58b298aa00e0ea748b0485c409847decfbd7ad55dd800b950f7ccf2cdf73d042cd1f9843c8eba006
SSDEEP

384:DJAkqG1XbYSkzzZFQMBwrFXxdg3oPfgcs80i4+Ke++WYzrDsJXSqV82/cspW0KCO:uqrYhPGc3oHJsqoiwdv82/rfNclRx8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1228	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1352	1228	rundll32.exe	28
PID 1228 wrote to memory of 1352	1228	rundll32.exe	28
PID 1228 wrote to memory of 1352	1228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\crunchunity.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1228 -s 84
  2⤵
  - Program crash
  PID:1352