ac597c69333f99b6d9f7b6deb58c8f19aaee37c6a2fc5c4155559c0531b6ceeb

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 00:23

Target

Crack Beast/vCRACK/libcurl.dll
Size

315KB
MD5

3ee6c736969785ce1693f57b40be2cbc
SHA1

1e7b2833ed2f47176de8c6734068270aeea823f8
SHA256

6309459acc19430da6ceb09009a5448c0e59ac456fb130f4ecedd9fbfb3e4de6
SHA512

68027a160f177d84a391f2e73a607861ed2173fb55258a9ef3ea7221ad2b582ab27f52349730bec3a99bad76ca3cc0ef794077a13ccb74b1b9daf9d3af7b41e4
SSDEEP

6144:0T+h+4GicZMZAUIzuRs7SyqS+cP7wJmEFD+ZLxnqoXXrkIphKHx:0T+h+fic0AUvYSyqlVHKcExi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	1964	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1964	1972	rundll32.exe	28
PID 1972 wrote to memory of 1964	1972	rundll32.exe	28
PID 1972 wrote to memory of 1964	1972	rundll32.exe	28
PID 1972 wrote to memory of 1964	1972	rundll32.exe	28
PID 1972 wrote to memory of 1964	1972	rundll32.exe	28
PID 1972 wrote to memory of 1964	1972	rundll32.exe	28
PID 1972 wrote to memory of 1964	1972	rundll32.exe	28
PID 1964 wrote to memory of 2024	1964	rundll32.exe	29
PID 1964 wrote to memory of 2024	1964	rundll32.exe	29
PID 1964 wrote to memory of 2024	1964	rundll32.exe	29
PID 1964 wrote to memory of 2024	1964	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\libcurl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\libcurl.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 232
    3⤵
    - Program crash
    PID:2024