21d01722dffd6a6052e92e89ea2f78a815e9f38d36126e18afca71457f65bd4f

Analysis

max time kernel
210s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 15:05

Target

Fraps/data/Lib/Lib2.dll
Size

208KB
MD5

9eefb97a2fd4bc1d3c43db1c86033b00
SHA1

ca03c90a99fca4360213869f1d1d06075bcba44a
SHA256

9e17951c529144886b1b7c36df7885033258528c795ab2b606e95d364c519f3d
SHA512

900977b8be48dbd2ec233a4b9a9e73598a2744c4e6bf95c7e64a61c0888390cf8b74310c025f3398d2666c867d44c353df50a81d0b403e8bd948cf547303fa4e
SSDEEP

3072:BVoWeMW1/5U/yaRisXt48Lj7oW8SA1AKl0Ckq0Dq88mIilWpoZ+3bbjko:z9IxWyapX3LjMWYCKl0CTeKmMM+J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4756	5096	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 5096	1116	rundll32.exe	80
PID 1116 wrote to memory of 5096	1116	rundll32.exe	80
PID 1116 wrote to memory of 5096	1116	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
  2⤵
  PID:5096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 600
    3⤵
    - Program crash
    PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5096 -ip 5096
1⤵
PID:3400