d9295df9fa4d59d8fe6615fca040897d1196c0adfa9b044c46256308045fc6ab

Analysis

max time kernel
36s
max time network
48s
platform
windows7_x64
resource
win7-20220812-es
resource tags

arch:x64arch:x86image:win7-20220812-eslocale:es-esos:windows7-x64systemwindows
submitted
30-01-2023 13:18

Target

Baba Is You/steam_api.dll
Size

214KB
MD5

7b857c897bc69313e4936dc3dcce5193
SHA1

4ee43374520904fa6d80c12c273d67eb7b5c984e
SHA256

5b6ef90f822209180ed5cafecb90af849ee84bcf6281eeb21be2f89b3b5c89b6
SHA512

be6406cc367815cc7b813adef24e5ddad6c8244d4964bd37ed0656aaae404496f4f9e38968e9acba91bff1db171127126d8219ebea8757142ebac0c82a233573
SSDEEP

3072:b1FYvn1HLSVcDywesfpTjEWIrnhaIB1ScHEq+XpBqmylcICNCxPJwa8Eo/8:BqvnFYFzsfECqSpBpybCNuhGR/8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

944 1696 WerFault.exe rundll32.exe

pid	pid_target	process	target process
944	1696	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1340 wrote to memory of 1696	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1696	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1696	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1696	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1696	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1696	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1696	1340	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	WerFault.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	WerFault.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	WerFault.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Baba Is You\steam_api.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Baba Is You\steam_api.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 224
3⤵
- Program crash
PID:944

memory/944-56-0x0000000000000000-mapping.dmp

Download
memory/1696-54-0x0000000000000000-mapping.dmp

Download
memory/1696-55-0x0000000075361000-0x0000000075363000-memory.dmp

Filesize
8KB

Download