d8a387313a1a41c983729bf989d7c99fe92315884cd1327da210b65c173e9574

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 15:47

Target

$SYSDIR/pncrt.dll
Size

272KB
MD5

13001eb0a58b4de96126b16ab15fd8cc
SHA1

4dfe6d2d02e9fa194f4af3d054b458b5a4bafbe6
SHA256

e983aa97fe1ce6af92f06433a71e03f54d3fc78392e26691cace927094bab8d7
SHA512

1a7c052bc1e7c824a3aff5e27c5cbd0720893e341dfb93062021b82c3a6d940c4ea23cbcdfaaeb174d90f51c36f0d8c62f693766f42172f894b6b689d26f49b2
SSDEEP

6144:3m7wHLiH0k6OgfjvQ0mvlxZ/PeT8Ah8EoHiIKaGo5RpTufufVvtr+dj7GcuT1JOy:3m7KLiHl6OgfjvQ0m93/5q+iIKaGo5Rr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	2020	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2020	3028	rundll32.exe	30
PID 3028 wrote to memory of 2020	3028	rundll32.exe	30
PID 3028 wrote to memory of 2020	3028	rundll32.exe	30
PID 3028 wrote to memory of 2020	3028	rundll32.exe	30
PID 3028 wrote to memory of 2020	3028	rundll32.exe	30
PID 3028 wrote to memory of 2020	3028	rundll32.exe	30
PID 3028 wrote to memory of 2020	3028	rundll32.exe	30
PID 2020 wrote to memory of 1968	2020	rundll32.exe	31
PID 2020 wrote to memory of 1968	2020	rundll32.exe	31
PID 2020 wrote to memory of 1968	2020	rundll32.exe	31
PID 2020 wrote to memory of 1968	2020	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\pncrt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\pncrt.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 224
    3⤵
    - Program crash
    PID:1968