ac597c69333f99b6d9f7b6deb58c8f19aaee37c6a2fc5c4155559c0531b6ceeb

Analysis

max time kernel
139s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 00:23

Target

Crack Beast/vCRACK/libcurl.dll
Size

315KB
MD5

3ee6c736969785ce1693f57b40be2cbc
SHA1

1e7b2833ed2f47176de8c6734068270aeea823f8
SHA256

6309459acc19430da6ceb09009a5448c0e59ac456fb130f4ecedd9fbfb3e4de6
SHA512

68027a160f177d84a391f2e73a607861ed2173fb55258a9ef3ea7221ad2b582ab27f52349730bec3a99bad76ca3cc0ef794077a13ccb74b1b9daf9d3af7b41e4
SSDEEP

6144:0T+h+4GicZMZAUIzuRs7SyqS+cP7wJmEFD+ZLxnqoXXrkIphKHx:0T+h+fic0AUvYSyqlVHKcExi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4476	4760	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4760	3120	rundll32.exe	92
PID 3120 wrote to memory of 4760	3120	rundll32.exe	92
PID 3120 wrote to memory of 4760	3120	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\libcurl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\libcurl.dll",#1
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 636
    3⤵
    - Program crash
    PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4760 -ip 4760
1⤵
PID:4832