c4714e7d9da25179abfd7e17c224d884353b55a73fdad433d2c5911f42392e82

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 23:07

Target

WC_CRACKA v0.02/YMSG12ENCRYPT.dll
Size

88KB
MD5

a1ec2d8ee6658551afc14cb14b76d008
SHA1

b0878653c569909428178a357c4afc7a3e9c8c9c
SHA256

8345aef1ef0fe0127ca4a0fa16ef7d0305877f1919fe43c9a98624d2019af2da
SHA512

65d3e8f4b524fc0fa3de827386e2d8e7a37c2c738f5ee4b220c5cf07463bd5a09dfbff49a6d951aaf9cb1a7051b659164be552d882acec54f16137973fe82d7f
SSDEEP

768:xZ7eomeyXwJx5UXFPqhiJOjtZC6uIn3YAlAyQngc69YdQZNV7coGKeX7O:xZmC7UXFCh9PC5jhz+VxG17O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	1816	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 1816 wrote to memory of 2100	1816	rundll32.exe	29
PID 1816 wrote to memory of 2100	1816	rundll32.exe	29
PID 1816 wrote to memory of 2100	1816	rundll32.exe	29
PID 1816 wrote to memory of 2100	1816	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\WC_CRACKA v0.02\YMSG12ENCRYPT.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\WC_CRACKA v0.02\YMSG12ENCRYPT.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 236
    3⤵
    - Program crash
    PID:2100