bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d

Analysis

max time kernel
258s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Target

PvZ_Tools_v2.7.3/Qt5Core.dll
Size

4.3MB
MD5

7d52fcdf2e5e3ecbf317040738976541
SHA1

f0375af2d143107081696c1b2310b3b8bc7efcdd
SHA256

57496b0ad87c47b0001645bac55283915eb01e7e7d5018679a09e97dafe08eb5
SHA512

7f0a8a9784b3b799738586367e817c857461a390c538c1d9d52020c994491c666e989a82179a2c9b2ca49e692b995df2a23841e5be76cc012721678ff888470d
SSDEEP

98304:k61wjWfPsbzZQKqU6QZWlY748XJsv6tWKFdu9CfvX/QKgwIkM:kozPEzZQKqXQZlHJsv6tWKFdu9CfDFN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1800 3048 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1800	3048	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1088 wrote to memory of 3048	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 3048	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 3048	1088	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\Qt5Core.dll,#1
2⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 676
3⤵
- Program crash
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3048 -ip 3048
1⤵
PID:4512