2da0191eafab3cb602e7902d4d1db29fc1a9e5feee5f699076cc83c4388e6b53

Analysis

max time kernel
118s
max time network
138s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 22:19

Target

CrackFix/ItsAMe_Origin.dll
Size

18KB
MD5

5dd3256a6c589156ff3e09a29e1c8145
SHA1

11ad79844825681f11c57a0ede5c3889b8d3b341
SHA256

4a42e539dc4c2680e4ff92d99e1945955dde4c440bd9218641ddffd57fd81b6b
SHA512

7f978820575ad83544f0cd69574a3b21be743dcad1d7455239d5edd383bc322ebb92744c4e7dd101c5741fdb54e1471c376c8676a5e70cfece7db8a94946b807
SSDEEP

192:QVjrA5uOlDOAgUCCK0uvA4jO0HDigCPTeu9vIQ5n7/V/tKFPDqHVHCnHmmabvY7q:Q9r4DDiDvAlOvCTe2Ag/Snwp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2812	1956	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2812	1956	rundll32.exe	14
PID 1956 wrote to memory of 2812	1956	rundll32.exe	14
PID 1956 wrote to memory of 2812	1956	rundll32.exe	14

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1956 -s 84
1⤵
- Program crash
PID:2812

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrackFix\ItsAMe_Origin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

memory/1956-0-0x000000003B400000-0x000000003B40D000-memory.dmp

Filesize
52KB

Download