c557ef35306f3c41ffc576287d2f4b58ae34f7e6370c0f5f6e2d4f23839b0cd9

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 01:55

Target

crunchunity.dll
Size

30KB
MD5

3adba526ae38591d5c7f880d1602ed0b
SHA1

52529a1679272a693d09622027e57623d6b6dcd0
SHA256

a23f2e66d83551795c941ca36086260a9b3b61d205779faf5f4f949a00393b41
SHA512

f60595f5a9703908b7af4349818c6d47ba6b70f2078561ae58b298aa00e0ea748b0485c409847decfbd7ad55dd800b950f7ccf2cdf73d042cd1f9843c8eba006
SSDEEP

384:DJAkqG1XbYSkzzZFQMBwrFXxdg3oPfgcs80i4+Ke++WYzrDsJXSqV82/cspW0KCO:uqrYhPGc3oHJsqoiwdv82/rfNclRx8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2388	2028	rundll32.exe	28
PID 2028 wrote to memory of 2388	2028	rundll32.exe	28
PID 2028 wrote to memory of 2388	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\crunchunity.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2028 -s 84
  2⤵
  PID:2388