ac597c69333f99b6d9f7b6deb58c8f19aaee37c6a2fc5c4155559c0531b6ceeb

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 00:23

Target

Crack Beast/vCRACK/msvcp140.dll
Size

429KB
MD5

1d8c79f293ca86e8857149fb4efe4452
SHA1

7474e7a5cb9c79c4b99fdf9fb50ef3011bef7e8f
SHA256

c09b126e7d4c1e6efb3ffcda2358252ce37383572c78e56ca97497a7f7c793e4
SHA512

83c4d842d4b07ba5cec559b6cd1c22ab8201941a667e7b173c405d2fc8862f7e5d9703e14bd7a1babd75165c30e1a2c95f9d1648f318340ea5e2b145d54919b1
SSDEEP

12288:oAoA7hbarg71r4RzfxjJhUgiW6QR7t5s03Ooc8dHkC2esq0Ju:oAoAN3r0Bm03Ooc8dHkC2eT0Ju

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	760	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 760	4700	rundll32.exe	89
PID 4700 wrote to memory of 760	4700	rundll32.exe	89
PID 4700 wrote to memory of 760	4700	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\msvcp140.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\msvcp140.dll",#1
  2⤵
  PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 604
    3⤵
    - Program crash
    PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 760 -ip 760
1⤵
PID:4500