87ae67e21b0e06cc2ed8cca9e98ddfe4efb3456cc677973e41b22efdfe10e350

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 18:26

Target

PayDay2 Level Hack 60/iphlpapi.dll
Size

63KB
MD5

ab7be16567d3325eaa760d4391df879a
SHA1

1bf91ae442de3295143e8f4aa8cc44b4f0a558ec
SHA256

f9ed851916d6cab9d9a993110823f03230c16176cc4e8447ad87769e7d3dc1f5
SHA512

00186e551dba7b1191af92823b7dfbd6097b0888ecd586830b910494b08bcc4741f18f73efe17492cb20dde21744b5e44ab780bcae5eebd294748081b9769833
SSDEEP

1536:vPO4LZMY0vU/NDhGOwart6NkwTuhWSlMYCXOtYJ2fmZJ:JLyvUlDEOw+YaUYWOtYJ/

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3244	820	WerFault.exe	84
1996	820	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 820	4680	rundll32.exe	84
PID 4680 wrote to memory of 820	4680	rundll32.exe	84
PID 4680 wrote to memory of 820	4680	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\PayDay2 Level Hack 60\iphlpapi.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\PayDay2 Level Hack 60\iphlpapi.dll",#1
  2⤵
  PID:820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 608
    3⤵
    - Program crash
    PID:3244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 568
    3⤵
    - Program crash
    PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 820 -ip 820
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 820 -ip 820
1⤵
PID:1984