63830c580968c7446bb9f94dd7919625ddd82e85e3314d5a33d28bd54d0c8076

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 20:52

Target

Combat arms Nx hack 2012/msvcr100d.dll
Size

1.4MB
MD5

d57e2eda325bac8081fd054209d736ae
SHA1

851852394c198131e49886421470ff2526123dc3
SHA256

5e47c4cf08450ea73d10e705fdce727ace66f8bcf4984028b1b17c91b8f630a6
SHA512

5261e89f80f2514fbcd45f657f7fad84aaa8c1ecdc41db669f8cbd2e4ed21868caae6c09e281cd957787f6311ea870fe668e611cc4fc5dd8d490c3cf79caa120
SSDEEP

24576:mnmwQbLmeBO0Gon8Tu8spx45/FYO3OxUh7Bv8MFZT2zmLy4mW2W:mGGon+dsp4YUOxMr5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	3056	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3056	2796	rundll32.exe	27
PID 2796 wrote to memory of 3056	2796	rundll32.exe	27
PID 2796 wrote to memory of 3056	2796	rundll32.exe	27
PID 2796 wrote to memory of 3056	2796	rundll32.exe	27
PID 2796 wrote to memory of 3056	2796	rundll32.exe	27
PID 2796 wrote to memory of 3056	2796	rundll32.exe	27
PID 2796 wrote to memory of 3056	2796	rundll32.exe	27
PID 3056 wrote to memory of 2800	3056	rundll32.exe	28
PID 3056 wrote to memory of 2800	3056	rundll32.exe	28
PID 3056 wrote to memory of 2800	3056	rundll32.exe	28
PID 3056 wrote to memory of 2800	3056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Combat arms Nx hack 2012\msvcr100d.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Combat arms Nx hack 2012\msvcr100d.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 224
    3⤵
    - Program crash
    PID:2800