501e5f1a1def69055a403df2277c56a0af9fe87d10b01a95612b1491f982a4a2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 05:04

Target

Crypter Cracked/module.dll
Size

11KB
MD5

f856ddf099cec1580f46514d0c3c23dd
SHA1

12e37572be5de69f8eeb51b2c9a4973b486aedc5
SHA256

43ec4d26c7d916a1cdd31ea1da763aa05d802ff82cbbdd4277d25c0c85ed7696
SHA512

43c2df09f7ff8fb94971c3a3d04f6e13abd3b7a397febe46ec168ad1da104c0c8511b463d4d9f2b205247e683e45ce9967e9ba4dbfe85a9c636852aa75f3f7f0
SSDEEP

96:vMPAEv0CdKklGNF6jJuWojnUKHKPZAbJGUu+Rs0v32DxmGIoP5IlcqoqC9cI4iZQ:vlq4NcoWgnde9kf2Db5IlGFZro+q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2412 wrote to memory of 2040	2412	rundll32.exe	30
PID 2412 wrote to memory of 2040	2412	rundll32.exe	30
PID 2412 wrote to memory of 2040	2412	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crypter Cracked\module.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2412 -s 68
  2⤵
  PID:2040