33b1cc24f787e0879be88253b5c445f9d4f9b0d8d678049dbf78fcdb94b65fe7

Analysis

max time kernel
117s
max time network
157s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:17

Target

Tool_1CD_2016v030_edit_mode/msvcr80.dll
Size

572KB
MD5

c404e1ff4b66f30e7914d629bb3ce67e
SHA1

07867033489724563509d28b218f2cbd27fc75a5
SHA256

5a4ed23a36dad0d97d85fc24609c5cec12103dc5af1fb807d081004d93cc7251
SHA512

06d42b2de52bb134009c6b9d6d8522e63bfa2018b7f943b3ac93a9ebaa8e6b1e829c2c4491bbf1db75173dba65babfa4151a092732b5f8d3fe9b884e3917bb5e
SSDEEP

12288:63nkXjV7Mi8pP3nt/Is0ADhKaJ796n+1diXgVlNVWmDOFhr4UC+9mGyw7:6XkTz8QADhKaJ8n+1diXgTNVWZp9mGyw

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2660	1568	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 2304 wrote to memory of 1568	2304	rundll32.exe	28
PID 2304 wrote to memory of 1568	2304	rundll32.exe	28
PID 2304 wrote to memory of 1568	2304	rundll32.exe	28
PID 2304 wrote to memory of 1568	2304	rundll32.exe	28
PID 2304 wrote to memory of 1568	2304	rundll32.exe	28
PID 2304 wrote to memory of 1568	2304	rundll32.exe	28
PID 2304 wrote to memory of 1568	2304	rundll32.exe	28
PID 1568 wrote to memory of 2660	1568	rundll32.exe	30
PID 1568 wrote to memory of 2660	1568	rundll32.exe	30
PID 1568 wrote to memory of 2660	1568	rundll32.exe	30
PID 1568 wrote to memory of 2660	1568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\msvcr80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\msvcr80.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 228
    3⤵
    - Program crash
    PID:2660