ac597c69333f99b6d9f7b6deb58c8f19aaee37c6a2fc5c4155559c0531b6ceeb

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 00:23

Target

Crack Beast/vCRACK/libssh2.dll
Size

114KB
MD5

cf8f8891e3a0ee42f3a25669c1113072
SHA1

9571ea714aafea664d53973d80617026515a7185
SHA256

3282f7d0640d6559218b249bd486cd026d97d22282034b380a55de7894ffbefb
SHA512

170ab50270c09a02c41829be3d37fa882076f48768ac262786a098375fc20dce1499f5685eb9cf8d502196a8eac64ea6274dcc2df2a85fb7e98dedaedf9c6d0d
SSDEEP

1536:6XpYG8AnM4IKqsOnenY1n78DPpNMAyhglsSdhJ+xzFdrcQYRbuiC+L2MAvehbG/K:6Xpbm5e6kP3htCbcQGjC+qXv6G/go

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2068	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2068 wrote to memory of 3048	2068	rundll32.exe	29
PID 2068 wrote to memory of 3048	2068	rundll32.exe	29
PID 2068 wrote to memory of 3048	2068	rundll32.exe	29
PID 2068 wrote to memory of 3048	2068	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\libssh2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\libssh2.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 220
    3⤵
    - Program crash
    PID:3048