0436fd55a874ef3acf5a5ce382b8fd43014d39e5a59f788c4b4f66d943b48ad8

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 17:49

Target

Anubis_Cracker_v1.2.1/msvcp100.dll
Size

593KB
MD5

4f096d96285e06cd51aef7d2d3de04da
SHA1

c90ef0eb5b1a0b1b85ad6792291747fb6307dcdb
SHA256

5bb420fbe28315f2117376052bb8488ce84a3398dda65005b8ae1f792017e9a8
SHA512

80f558c50a71ad9c4930b3838b481e4fb453c38d57c91f7f70c1f86e4043b9a4fbcec27d7c025285504cbf3bde7c50b4770f18121d7818ac58e2ee9c2071f97c
SSDEEP

12288:uoBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblH6t2:LFUsQ1H5FHdggrNvEKZm+aWodEEIH6t2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2512	1700	rundll32.exe	28
PID 1700 wrote to memory of 2512	1700	rundll32.exe	28
PID 1700 wrote to memory of 2512	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Anubis_Cracker_v1.2.1\msvcp100.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1700 -s 84
  2⤵
  PID:2512