bdb39f248d0cd06c086b5e38a8120fa4feb9208a4236f32b23e601a4037be416

Resubmissions

21-08-2023 15:40

11-08-2023 19:23

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
11-08-2023 19:23

Target

Predictor V6.3/api-ms-win-crt-private-l1-1-0.dll
Size

69KB
MD5

50740f0bc326f0637c4166698298d218
SHA1

0c33cfe40edd278a692c2e73e941184fd24286d9
SHA256

adbb658dd1cbecaca7cc1322b51976f30b36ccf0a751f3bad1f29d350b192c9c
SHA512

f1331ab1d52fb681f51546168e9736e2f6163e0706955e85ac9e4544d575d50e6eacd90ea3e49cb8b69da34fe0b621b04661f0b6f09f7ce8ceca50308c263d03
SSDEEP

1536:W7bLPuDe5c4bFe2JyhcvxXWpD7d3334BkZn3P9IVlqHh:WyDe5c4bFe2JyhcvxXWpD7d3334BkZnB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2468 2760 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2468	2760	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2760 wrote to memory of 2468	2760	rundll32.exe	WerFault.exe
PID 2760 wrote to memory of 2468	2760	rundll32.exe	WerFault.exe
PID 2760 wrote to memory of 2468	2760	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Predictor V6.3\api-ms-win-crt-private-l1-1-0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2760 -s 84
2⤵
- Program crash
PID:2468