37303fb01243d97e33ba24953ea1a9d711780c054a1d8e2cc326e29128b04153

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2023, 02:42

Target

steam_api.dll
Size

253KB
MD5

1c14e50d5dddcb1f3ca0bb9a34eaaca5
SHA1

aa404cbec1bb9614514e342bbda64a9416e02336
SHA256

14a33924adc495f3c27dde65ae4a8007c8acdc1454fcf87f02d12040cd751741
SHA512

7ba189e1332b655f4c2d2a3f801e00db136c3d1626f2a5402539b1810df93f96d92c92f68f370380bf88df6646aca34fdd94bba2c1f342ac490b6b3a410ce01d
SSDEEP

3072:YMcvPbwWDeN3O8nQC2mCtsuZTMS9OTUSFSkaSQimnPWxyN+WebUIIC0zmNJa9V:dc3bns3OWUTMSgYSFFFynC0SNM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	2832	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 2832	3776	rundll32.exe	83
PID 3776 wrote to memory of 2832	3776	rundll32.exe	83
PID 3776 wrote to memory of 2832	3776	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\steam_api.dll,#1
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 612
    3⤵
    - Program crash
    PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2832 -ip 2832
1⤵
PID:1036