6122dfa6ce8b8da8177dafb307d3719059610f8001ae3849f27e27e4814b6b21

Analysis

max time kernel
395s
max time network
408s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
03/07/2023, 16:06

Target

Crack Setup/dll/DLL_AnalyzeGesturesInOne.dll
Size

61KB
MD5

06302fa1044ce5f410b4e50b45ee89d0
SHA1

cc6930123b6bf912f497d46f9e7916645422462a
SHA256

30ea045a8804aea07d4c10a1b65029459d45075033db71f91c5ddce9c35656f1
SHA512

105adebd3f237c0fd1d89fdd558fcf9093cd8f56bba31a64e68c32c4e94b3d65037ef690c5ce317cf192ceb688c68475a04ac744d9b1b6b94e8b194fed84d64e
SSDEEP

768:/M+87yTZDoZZlLQ2Gh+Ex252IcuEnbRwkW/GnTEDWqADvMMycB:/M+XSdQ2KLnFwAlD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2032	1756	rundll32.exe	28
PID 1756 wrote to memory of 2032	1756	rundll32.exe	28
PID 1756 wrote to memory of 2032	1756	rundll32.exe	28
PID 1756 wrote to memory of 2032	1756	rundll32.exe	28
PID 1756 wrote to memory of 2032	1756	rundll32.exe	28
PID 1756 wrote to memory of 2032	1756	rundll32.exe	28
PID 1756 wrote to memory of 2032	1756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Setup\dll\DLL_AnalyzeGesturesInOne.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Setup\dll\DLL_AnalyzeGesturesInOne.dll",#1
  2⤵
  PID:2032