f6e85a09d34fee8569e913af2a11addf2a6a640e22f2a92e691576bbc89de411

Analysis

max time kernel
20s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/03/2023, 00:24

Target

Undertale/lua5.1.dll
Size

322KB
MD5

c3f5f4a1fb69b5889f0bbb313cf6017f
SHA1

e4f592cfbd62a3c3caf27177ccea5a77afa649bb
SHA256

769416fa7edf38e91a55f4f7163914ee4aad9c8c890ed641c300b73157acac45
SHA512

e17d3be36fd2ba892d945f3737ebffdefe6d476224ef3459b567579971559a048a886941f57ae671b3df32844f99575a14c72ef8c49c2d4b1e8352204ccc05ab
SSDEEP

6144:+kn2LG5bwf92+0HiDhAqUS0aMkhwfDRAOj+JzOg7Fp:72x2cdUhZcIDR8xhp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1692	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1692	1744	rundll32.exe	28
PID 1744 wrote to memory of 1692	1744	rundll32.exe	28
PID 1744 wrote to memory of 1692	1744	rundll32.exe	28
PID 1744 wrote to memory of 1692	1744	rundll32.exe	28
PID 1744 wrote to memory of 1692	1744	rundll32.exe	28
PID 1744 wrote to memory of 1692	1744	rundll32.exe	28
PID 1744 wrote to memory of 1692	1744	rundll32.exe	28
PID 1692 wrote to memory of 1964	1692	rundll32.exe	29
PID 1692 wrote to memory of 1964	1692	rundll32.exe	29
PID 1692 wrote to memory of 1964	1692	rundll32.exe	29
PID 1692 wrote to memory of 1964	1692	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Undertale\lua5.1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Undertale\lua5.1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 228
    3⤵
    - Program crash
    PID:1964