d1f79e21431b19c736e73266c8587148c1e39a4ecb54217e37f0cd71bc0a480a

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/01/2023, 20:14

Target

EA DLC Unlocker v2/ea_desktop/version.dll
Size

238KB
MD5

df7eabf56d49ebd775f92fa67a0071d6
SHA1

7dff8092b62a7f400e3aef760e643ad948d533c5
SHA256

d6086904aa3c47a04f9651cad2d2d4be3d50ae93b4bbc5b5b7bd63dc86eb2ec6
SHA512

ecfb1e8e259fbcb45c00c858a90d11a73304baea9f27474c9ffd439177098412f6009dc8f5ef48ab496e82910a5454836a7c33c3e82cbb9dfb5c3866b8a880f6
SSDEEP

3072:8iPe/BusENL4M8MzYg2GOPSkc+0j6kML3lHq91QQevXDDsC1fxgKT/mqs/KFQizn:LPe/BKVmqkQ6kMB5HnsSFQP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	1328	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1288	1328	rundll32.exe	28
PID 1328 wrote to memory of 1288	1328	rundll32.exe	28
PID 1328 wrote to memory of 1288	1328	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\ea_desktop\version.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1328 -s 96
  2⤵
  - Program crash
  PID:1288