bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d

Analysis

max time kernel
258s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Target

PvZ_Tools_v2.7.3/Qt5Core.dll
Size

4.3MB
MD5

7d52fcdf2e5e3ecbf317040738976541
SHA1

f0375af2d143107081696c1b2310b3b8bc7efcdd
SHA256

57496b0ad87c47b0001645bac55283915eb01e7e7d5018679a09e97dafe08eb5
SHA512

7f0a8a9784b3b799738586367e817c857461a390c538c1d9d52020c994491c666e989a82179a2c9b2ca49e692b995df2a23841e5be76cc012721678ff888470d
SSDEEP

98304:k61wjWfPsbzZQKqU6QZWlY748XJsv6tWKFdu9CfvX/QKgwIkM:kozPEzZQKqXQZlHJsv6tWKFdu9CfDFN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1800	3048	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 3048	1088	rundll32.exe	85
PID 1088 wrote to memory of 3048	1088	rundll32.exe	85
PID 1088 wrote to memory of 3048	1088	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\Qt5Core.dll,#1
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 676
    3⤵
    - Program crash
    PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3048 -ip 3048
1⤵
PID:4512