2fa77bcc3f5b0cc3f9d83478acd366b63305d77cb0d7ee95fc51c5a26a634b4b

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 21:58

Target

GwithFFixOnlyv3/Golf With Your Friends_Data/Plugins/x86_64/steam_api64.dll
Size

282KB
MD5

2bca4e2c047ec969cb3cff277e7fc184
SHA1

c4b5b00b605e59c6fdcb6731f2e53069506e287a
SHA256

f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
SHA512

3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
SSDEEP

6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	892	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 836	892	rundll32.exe	28
PID 892 wrote to memory of 836	892	rundll32.exe	28
PID 892 wrote to memory of 836	892	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\GwithFFixOnlyv3\Golf With Your Friends_Data\Plugins\x86_64\steam_api64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 892 -s 120
  2⤵
  - Program crash
  PID:836