c4714e7d9da25179abfd7e17c224d884353b55a73fdad433d2c5911f42392e82

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 23:07

Target

WC_CRACKA v0.02/YMSG12ENCRYPT.dll
Size

88KB
MD5

a1ec2d8ee6658551afc14cb14b76d008
SHA1

b0878653c569909428178a357c4afc7a3e9c8c9c
SHA256

8345aef1ef0fe0127ca4a0fa16ef7d0305877f1919fe43c9a98624d2019af2da
SHA512

65d3e8f4b524fc0fa3de827386e2d8e7a37c2c738f5ee4b220c5cf07463bd5a09dfbff49a6d951aaf9cb1a7051b659164be552d882acec54f16137973fe82d7f
SSDEEP

768:xZ7eomeyXwJx5UXFPqhiJOjtZC6uIn3YAlAyQngc69YdQZNV7coGKeX7O:xZmC7UXFCh9PC5jhz+VxG17O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4180	3176	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3176	3480	rundll32.exe	83
PID 3480 wrote to memory of 3176	3480	rundll32.exe	83
PID 3480 wrote to memory of 3176	3480	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\WC_CRACKA v0.02\YMSG12ENCRYPT.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\WC_CRACKA v0.02\YMSG12ENCRYPT.dll",#1
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 620
    3⤵
    - Program crash
    PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3176 -ip 3176
1⤵
PID:1592