486b1ff53fb896c08eb98df156d8e36a1c88285ee109c7f27adc0c41ef0762ea

Resubmissions

19/11/2024, 13:13

19/11/2024, 13:11

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:13

Target

CRIMSON/Bin/xxhash.dll
Size

46KB
MD5

70c514826d9428f184d27f0c8f397404
SHA1

e6b0b1a396de9913004d9bcaa230972686416bb6
SHA256

aff59e91d222b75b3e3ac789baba9e24eff99796261ae5e887ef9e3c28bb3d64
SHA512

168c63cbb54865ca42a884fd974291bcadd9dd8cf8bc1980148214e84498af42a590cb3d3a394765ee0b7d2e337fab6e85ff4f85d9ced97b92b540152202a0a6
SSDEEP

768:tziPp7yW4k3QDn24NuDUSu0MKQVMNKuxYAuogba4Mk3Q18swN1WQ8hi6U:tziR74kgDn2rDRuIrN5mAvgbTg18DN1z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1720	2436	rundll32.exe	30
PID 2436 wrote to memory of 1720	2436	rundll32.exe	30
PID 2436 wrote to memory of 1720	2436	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CRIMSON\Bin\xxhash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2436 -s 80
  2⤵
  PID:1720