c79f3697cc8671dd38370f3ce88dd86792ee0f183f0aa4cbdc1603df4eba2d8a

Analysis

max time kernel
73s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2023, 04:26

Target

LeagueTagsFree-win32-ia32/api-ms-win-core-interlocked-l1-1-0.dll
Size

17KB
MD5

d97a1cb141c6806f0101a5ed2673a63d
SHA1

d31a84c1499a9128a8f0efea4230fcfa6c9579be
SHA256

deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c
SHA512

0e3202041def9d2278416b7826c61621dced6dee8269507ce5783c193771f6b26d47feb0700bbe937d8aff9f7489890b5263d63203b5ba99e0b4099a5699c620
SSDEEP

192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3404	4364	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4364	4344	rundll32.exe	84
PID 4344 wrote to memory of 4364	4344	rundll32.exe	84
PID 4344 wrote to memory of 4364	4344	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LeagueTagsFree-win32-ia32\api-ms-win-core-interlocked-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LeagueTagsFree-win32-ia32\api-ms-win-core-interlocked-l1-1-0.dll,#1
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 600
    3⤵
    - Program crash
    PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4364 -ip 4364
1⤵
PID:4164