63830c580968c7446bb9f94dd7919625ddd82e85e3314d5a33d28bd54d0c8076

Analysis

max time kernel
132s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 20:52

Target

Combat arms Nx hack 2012/msvcr100d.dll
Size

1.4MB
MD5

d57e2eda325bac8081fd054209d736ae
SHA1

851852394c198131e49886421470ff2526123dc3
SHA256

5e47c4cf08450ea73d10e705fdce727ace66f8bcf4984028b1b17c91b8f630a6
SHA512

5261e89f80f2514fbcd45f657f7fad84aaa8c1ecdc41db669f8cbd2e4ed21868caae6c09e281cd957787f6311ea870fe668e611cc4fc5dd8d490c3cf79caa120
SSDEEP

24576:mnmwQbLmeBO0Gon8Tu8spx45/FYO3OxUh7Bv8MFZT2zmLy4mW2W:mGGon+dsp4YUOxMr5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4368	4612	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4612	4784	rundll32.exe	88
PID 4784 wrote to memory of 4612	4784	rundll32.exe	88
PID 4784 wrote to memory of 4612	4784	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Combat arms Nx hack 2012\msvcr100d.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Combat arms Nx hack 2012\msvcr100d.dll",#1
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 600
    3⤵
    - Program crash
    PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4612 -ip 4612
1⤵
PID:3884