e7e50678a688b5a7bd3b76ca1e948809590ebff535881f9d245dafbfb8b3dc11

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 13:44

Target

pncrt.dll
Size

272KB
MD5

13001eb0a58b4de96126b16ab15fd8cc
SHA1

4dfe6d2d02e9fa194f4af3d054b458b5a4bafbe6
SHA256

e983aa97fe1ce6af92f06433a71e03f54d3fc78392e26691cace927094bab8d7
SHA512

1a7c052bc1e7c824a3aff5e27c5cbd0720893e341dfb93062021b82c3a6d940c4ea23cbcdfaaeb174d90f51c36f0d8c62f693766f42172f894b6b689d26f49b2
SSDEEP

6144:3m7wHLiH0k6OgfjvQ0mvlxZ/PeT8Ah8EoHiIKaGo5RpTufufVvtr+dj7GcuT1JOy:3m7KLiHl6OgfjvQ0m93/5q+iIKaGo5Rr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2928	2232	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2232	2896	rundll32.exe	17
PID 2896 wrote to memory of 2232	2896	rundll32.exe	17
PID 2896 wrote to memory of 2232	2896	rundll32.exe	17
PID 2896 wrote to memory of 2232	2896	rundll32.exe	17
PID 2896 wrote to memory of 2232	2896	rundll32.exe	17
PID 2896 wrote to memory of 2232	2896	rundll32.exe	17
PID 2896 wrote to memory of 2232	2896	rundll32.exe	17
PID 2232 wrote to memory of 2928	2232	rundll32.exe	16
PID 2232 wrote to memory of 2928	2232	rundll32.exe	16
PID 2232 wrote to memory of 2928	2232	rundll32.exe	16
PID 2232 wrote to memory of 2928	2232	rundll32.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 224
1⤵
- Program crash
PID:2928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pncrt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pncrt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896