501e5f1a1def69055a403df2277c56a0af9fe87d10b01a95612b1491f982a4a2

Analysis

max time kernel
74s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05/11/2024, 11:25

Target

Crypter Cracked/libffi-7.dll
Size

32KB
MD5

eef7981412be8ea459064d3090f4b3aa
SHA1

c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256

f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512

dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP

384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2044	2116	rundll32.exe	30
PID 2116 wrote to memory of 2044	2116	rundll32.exe	30
PID 2116 wrote to memory of 2044	2116	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crypter Cracked\libffi-7.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2116 -s 84
  2⤵
  PID:2044