c79f3697cc8671dd38370f3ce88dd86792ee0f183f0aa4cbdc1603df4eba2d8a

Analysis

max time kernel
23s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/04/2023, 04:26

Target

LeagueTagsFree-win32-ia32/api-ms-win-core-interlocked-l1-1-0.dll
Size

17KB
MD5

d97a1cb141c6806f0101a5ed2673a63d
SHA1

d31a84c1499a9128a8f0efea4230fcfa6c9579be
SHA256

deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c
SHA512

0e3202041def9d2278416b7826c61621dced6dee8269507ce5783c193771f6b26d47feb0700bbe937d8aff9f7489890b5263d63203b5ba99e0b4099a5699c620
SSDEEP

192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	1584	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1584	928	rundll32.exe	27
PID 928 wrote to memory of 1584	928	rundll32.exe	27
PID 928 wrote to memory of 1584	928	rundll32.exe	27
PID 928 wrote to memory of 1584	928	rundll32.exe	27
PID 928 wrote to memory of 1584	928	rundll32.exe	27
PID 928 wrote to memory of 1584	928	rundll32.exe	27
PID 928 wrote to memory of 1584	928	rundll32.exe	27
PID 1584 wrote to memory of 1632	1584	rundll32.exe	28
PID 1584 wrote to memory of 1632	1584	rundll32.exe	28
PID 1584 wrote to memory of 1632	1584	rundll32.exe	28
PID 1584 wrote to memory of 1632	1584	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LeagueTagsFree-win32-ia32\api-ms-win-core-interlocked-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LeagueTagsFree-win32-ia32\api-ms-win-core-interlocked-l1-1-0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 224
    3⤵
    - Program crash
    PID:1632