75ce91d4f361227c1275a326653533c5eaa494b87dd96c529b03d0a3a6ff9ae2

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 01:23

Target

ORIONX-FUD-CRYPTER-main/main/sys/VCRUNTIME140.dll
Size

106KB
MD5

4585a96cc4eef6aafd5e27ea09147dc6
SHA1

489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256

a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512

d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP

1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2392	1768	rundll32.exe	28
PID 1768 wrote to memory of 2392	1768	rundll32.exe	28
PID 1768 wrote to memory of 2392	1768	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ORIONX-FUD-CRYPTER-main\main\sys\VCRUNTIME140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1768 -s 84
  2⤵
  PID:2392