19ffd1a91a314949cc063044b209a652278778785c12db5b27d37a7c4bf14961

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 09:13

Target

Skill Hack WarRock-Hacker.de[9.Juni.2009].dll
Size

212KB
MD5

1ff1585682319d720f0dd3f3b3d6f0b2
SHA1

2ec7f71e3258f35f59599a7f3dc18e3013a79b83
SHA256

305fe513dec9e9b744112d217b4172d6aabd4695316b55deac27023605442f8a
SHA512

1dfeec25b085ff430c1cbb2ff5dd4953ddc12a92811ed30146732c4810ef617182d598c0422e165d4c83b365a47de74f2aec8862741203a7e0ada32f99ddd76d
SSDEEP

1536:lHfDU5U8pl8gMsAoTMSRXljNAauuSpQ44qOUFC5w3gDVlpFinT1mnkN+8toPzM:5A5U83v8vSRXljNAa+nTIa+8toI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	1584	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 1584 wrote to memory of 3044	1584	rundll32.exe	29
PID 1584 wrote to memory of 3044	1584	rundll32.exe	29
PID 1584 wrote to memory of 3044	1584	rundll32.exe	29
PID 1584 wrote to memory of 3044	1584	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Skill Hack WarRock-Hacker.de[9.Juni.2009].dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Skill Hack WarRock-Hacker.de[9.Juni.2009].dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 244
    3⤵
    - Program crash
    PID:3044