7b8c0cdbbef7a4486fd8dfbf0ce163a68ee797418f78a375b716dd64e313e352

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 01:22

Sharing

Target
slinky crack/slinkyhook.dll
Size 228KB
Sample240616-brrfkatcng
SHA256 7c4234fac3b6b3e96dace1e71c7a952ec67e3839f90f7a88a9ea283bf88d25b8
MD5 6d8c17c67970cb5841811eed8adffffc
SHA1 c869ab32318a035e51aff8e5e11b4cd25fb52a4f
SHA512 7d2a0ffcd72c8bf4a96b2ed722d7119749ec14f5d7e6a601cb6ae4a5b1c4a652b694158f01da340e3ca4751cabd0a56c42bf739d8b421e36937f3691b3b80c72
SSDEEP 3072:hXxN1I6PgabbAzVxPLI5oIa5amK/1o4ptgELHY1lNyc+m+e7P26g66OVuknsDe0u:hhN1GFZq/15tFc+m97ieuknsDu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3004	2936	rundll32.exe	28
PID 2936 wrote to memory of 3004	2936	rundll32.exe	28
PID 2936 wrote to memory of 3004	2936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\slinky crack\slinkyhook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2936 -s 160
  2⤵
  PID:3004