6043e79b7b303aeab66b9db5257e228eb6f751d51338db0f262485b171a89286

Analysis

max time kernel
65s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-01-2023 03:25

Target

Ryujinx.exe
Size

46.7MB
MD5

52cfd2b201487d11a5f03edd3855df62
SHA1

3692d2503210b2e6a1c4c19e747dfbe0aced6ae9
SHA256

6043e79b7b303aeab66b9db5257e228eb6f751d51338db0f262485b171a89286
SHA512

bdb14a20b876b9bc362a1a99e5ee3700eb75c7ba81d49e34429192a72e74cf5600bf93c1a86ce262ffc8678f20447b850ea9cea392833bd27930cfdddf30e479
SSDEEP

196608:kNO2/ZVOoAABOowGwzwkxMyaXemGMtv2kTTYHpGuC9Kmg9W4pzNWVBbvY582DL7d:EjVOo/D4+ySzlaBM7GT0A6IuM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1268 1956 WerFault.exe Ryujinx.exe

pid	pid_target	process	target process
1268	1956	WerFault.exe	Ryujinx.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Ryujinx.exe

description	pid	process	target process
PID 1956 wrote to memory of 1268	1956	Ryujinx.exe	WerFault.exe
PID 1956 wrote to memory of 1268	1956	Ryujinx.exe	WerFault.exe
PID 1956 wrote to memory of 1268	1956	Ryujinx.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Ryujinx.exe
"C:\Users\Admin\AppData\Local\Temp\Ryujinx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1956 -s 1004
2⤵
- Program crash
PID:1268