ac597c69333f99b6d9f7b6deb58c8f19aaee37c6a2fc5c4155559c0531b6ceeb

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 00:23

Target

Crack Beast/vCRACK/msvcp140.dll
Size

429KB
MD5

1d8c79f293ca86e8857149fb4efe4452
SHA1

7474e7a5cb9c79c4b99fdf9fb50ef3011bef7e8f
SHA256

c09b126e7d4c1e6efb3ffcda2358252ce37383572c78e56ca97497a7f7c793e4
SHA512

83c4d842d4b07ba5cec559b6cd1c22ab8201941a667e7b173c405d2fc8862f7e5d9703e14bd7a1babd75165c30e1a2c95f9d1648f318340ea5e2b145d54919b1
SSDEEP

12288:oAoA7hbarg71r4RzfxjJhUgiW6QR7t5s03Ooc8dHkC2esq0Ju:oAoAN3r0Bm03Ooc8dHkC2eT0Ju

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2160	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2160	2924	rundll32.exe	28
PID 2924 wrote to memory of 2160	2924	rundll32.exe	28
PID 2924 wrote to memory of 2160	2924	rundll32.exe	28
PID 2924 wrote to memory of 2160	2924	rundll32.exe	28
PID 2924 wrote to memory of 2160	2924	rundll32.exe	28
PID 2924 wrote to memory of 2160	2924	rundll32.exe	28
PID 2924 wrote to memory of 2160	2924	rundll32.exe	28
PID 2160 wrote to memory of 2800	2160	rundll32.exe	29
PID 2160 wrote to memory of 2800	2160	rundll32.exe	29
PID 2160 wrote to memory of 2800	2160	rundll32.exe	29
PID 2160 wrote to memory of 2800	2160	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\msvcp140.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\msvcp140.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 220
    3⤵
    - Program crash
    PID:2800