cd660bd4d4f7d33920a2c18be331041ba80d7770e1c47153a5dfae6da3f5e43e

Analysis

max time kernel
98s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15-06-2023 05:33

Target

Crafty-v1.1/runtimes/win-x86/native/av_libglesv2.dll
Size

3.2MB
MD5

c2b853790468c88c21ec7b6e21959313
SHA1

54bca8b373eba2196cf47b497734ebe3aaa0d37a
SHA256

b5f682067664bf44f92418d57097876b9ffb656c4e1e496d7f056eb3f910e5d8
SHA512

cb885aaaba3a6bb4770d86d0ff6cc6bf499fae945fbf45680bf3682a20bcb4af4b9ecd4e31172cfa090b630d8e749a120d31fd0436e2ffd50efe55146f6744ab
SSDEEP

49152:9nm84lPJ9YOUCXg4/OuBuitPB5W4pifrmvzrjBTSBYWxXzfjhCAZmfYM:9nhEJSOfQ4/LB9b5WxB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 1816 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1260	1816	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2320 wrote to memory of 1816	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 1816	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 1816	2320	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Crafty-v1.1\runtimes\win-x86\native\av_libglesv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Crafty-v1.1\runtimes\win-x86\native\av_libglesv2.dll,#1
2⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 612
3⤵
- Program crash
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1816 -ip 1816
1⤵
PID:1556