21d01722dffd6a6052e92e89ea2f78a815e9f38d36126e18afca71457f65bd4f

Analysis

max time kernel
149s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 15:05

Target

Fraps/data/Lib/Lib2.dll
Size

123KB
MD5

b66e8ef9760059c214c231ada9e2eca3
SHA1

bcb851ffc8620eb78cec32b34cca6e204b76690b
SHA256

8e004b21397da84103f8e0d0eef82f561115f51c8b13c6987e103bbfc23d3246
SHA512

e42a4b48a385833fa4c4e81c452f116616df4981c92da6571a690716ce71335578e1bd9bbccca1669cbd2a61d5207336aca4f7c58122795bcc1420bb5f808a35
SSDEEP

3072:eIoBlNE71LDuw644Cc9VJjkIG7SkOxZVYDht:ijNiHuw6F3aDX

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
220	1776	WerFault.exe	82
4816	1776	WerFault.exe	82

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1776	644	rundll32.exe	82
PID 644 wrote to memory of 1776	644	rundll32.exe	82
PID 644 wrote to memory of 1776	644	rundll32.exe	82
PID 1776 wrote to memory of 220	1776	rundll32.exe	85
PID 1776 wrote to memory of 220	1776	rundll32.exe	85
PID 1776 wrote to memory of 220	1776	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 600
    3⤵
    - Program crash
    PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 600
    3⤵
    - Program crash
    PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1776 -ip 1776
1⤵
PID:4156