ac597c69333f99b6d9f7b6deb58c8f19aaee37c6a2fc5c4155559c0531b6ceeb

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 00:23

Target

Crack Beast/vCRACK/libssh2.dll
Size

114KB
MD5

cf8f8891e3a0ee42f3a25669c1113072
SHA1

9571ea714aafea664d53973d80617026515a7185
SHA256

3282f7d0640d6559218b249bd486cd026d97d22282034b380a55de7894ffbefb
SHA512

170ab50270c09a02c41829be3d37fa882076f48768ac262786a098375fc20dce1499f5685eb9cf8d502196a8eac64ea6274dcc2df2a85fb7e98dedaedf9c6d0d
SSDEEP

1536:6XpYG8AnM4IKqsOnenY1n78DPpNMAyhglsSdhJ+xzFdrcQYRbuiC+L2MAvehbG/K:6Xpbm5e6kP3htCbcQGjC+qXv6G/go

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1796	2556	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 2556	3112	rundll32.exe	89
PID 3112 wrote to memory of 2556	3112	rundll32.exe	89
PID 3112 wrote to memory of 2556	3112	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\libssh2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\libssh2.dll",#1
  2⤵
  PID:2556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 628
    3⤵
    - Program crash
    PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2556 -ip 2556
1⤵
PID:3592