c071c0232917e0234be096d059852c6e35d27b2d9515b712907c8d16837506d0

Analysis

max time kernel
1614s
max time network
1618s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/05/2023, 00:02

Target

GameAssembly.dll
Size

17.0MB
MD5

fec3d91ab202e5e2329f5b2aaa154b39
SHA1

0253616e175325a0797dbe7b49395bc67f74abd9
SHA256

a539b80bd85c3a48da5f9893056079bc98dbba57f1948785429056d0fd9b64c0
SHA512

ea90811b1e67e7f413d35b1785387679edd73ca1173c622f3ed7b546d408efd69306f86c079013facbe4a21ae8d9f1f987ac59fa33d2979c843f19ff8e181e28
SSDEEP

196608:7pb9EOzN6Kfe1gIWtIeQzGtfRPqocIC6pO4nWNVGnbfG8d4zD:7FzN6Kfe1gIwIRGxRPqocIJTngVGqV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	1344	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GameAssembly.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1344 -s 264
  2⤵
  - Program crash
  PID:1300