d34bb6bf1ccc0ce74188aeac4527392967f130f03b77d1e8767dee02106fa235

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 04:12

Target

$SYSDIR/pncrt.dll
Size

272KB
MD5

13001eb0a58b4de96126b16ab15fd8cc
SHA1

4dfe6d2d02e9fa194f4af3d054b458b5a4bafbe6
SHA256

e983aa97fe1ce6af92f06433a71e03f54d3fc78392e26691cace927094bab8d7
SHA512

1a7c052bc1e7c824a3aff5e27c5cbd0720893e341dfb93062021b82c3a6d940c4ea23cbcdfaaeb174d90f51c36f0d8c62f693766f42172f894b6b689d26f49b2
SSDEEP

6144:3m7wHLiH0k6OgfjvQ0mvlxZ/PeT8Ah8EoHiIKaGo5RpTufufVvtr+dj7GcuT1JOy:3m7KLiHl6OgfjvQ0m93/5q+iIKaGo5Rr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2744	2964	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2964	2820	rundll32.exe	30
PID 2820 wrote to memory of 2964	2820	rundll32.exe	30
PID 2820 wrote to memory of 2964	2820	rundll32.exe	30
PID 2820 wrote to memory of 2964	2820	rundll32.exe	30
PID 2820 wrote to memory of 2964	2820	rundll32.exe	30
PID 2820 wrote to memory of 2964	2820	rundll32.exe	30
PID 2820 wrote to memory of 2964	2820	rundll32.exe	30
PID 2964 wrote to memory of 2744	2964	rundll32.exe	31
PID 2964 wrote to memory of 2744	2964	rundll32.exe	31
PID 2964 wrote to memory of 2744	2964	rundll32.exe	31
PID 2964 wrote to memory of 2744	2964	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\pncrt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\pncrt.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 224
    3⤵
    - Program crash
    PID:2744