c79f3697cc8671dd38370f3ce88dd86792ee0f183f0aa4cbdc1603df4eba2d8a

Analysis

max time kernel
11s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-04-2023 04:26

Target

LeagueTagsFree-win32-ia32/api-ms-win-core-debug-l1-1-0.dll
Size

17KB
MD5

88ff191fd8648099592ed28ee6c442a5
SHA1

6a4f818b53606a5602c609ec343974c2103bc9cc
SHA256

c310cc91464c9431ab0902a561af947fa5c973925ff70482d3de017ed3f73b7d
SHA512

942ae86550d4a4886dac909898621dab18512c20f3d694a8ad444220aead76fa88c481df39f93c7074dbbc31c3b4daf97099cfed86c2a0aaa4b63190a4b307fd
SSDEEP

384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1616	1888	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1888	1608	rundll32.exe	26
PID 1608 wrote to memory of 1888	1608	rundll32.exe	26
PID 1608 wrote to memory of 1888	1608	rundll32.exe	26
PID 1608 wrote to memory of 1888	1608	rundll32.exe	26
PID 1608 wrote to memory of 1888	1608	rundll32.exe	26
PID 1608 wrote to memory of 1888	1608	rundll32.exe	26
PID 1608 wrote to memory of 1888	1608	rundll32.exe	26
PID 1888 wrote to memory of 1616	1888	rundll32.exe	27
PID 1888 wrote to memory of 1616	1888	rundll32.exe	27
PID 1888 wrote to memory of 1616	1888	rundll32.exe	27
PID 1888 wrote to memory of 1616	1888	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LeagueTagsFree-win32-ia32\api-ms-win-core-debug-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LeagueTagsFree-win32-ia32\api-ms-win-core-debug-l1-1-0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 224
    3⤵
    - Program crash
    PID:1616