054516ec9653a0216348890d953c7367e441ec56311163ffac63b5c849237afd

Analysis

max time kernel
56s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2023 12:55

Target

Game.dll
Size

654KB
MD5

a9a673f3a28d48a55a0110af24f8e992
SHA1

acb7276e6fdd045e24782c4e64fc7c33eff08e31
SHA256

c166e43823c95bb2b9d86ef727960d088e084c4cc67f1b21e1c23f47db129b71
SHA512

19ce6e8500388a92924a4f33018f16cbaa9c13c627399e2ae312149128e0c00d4619075002568b80af556375397c3bd2e808277ffdc7eb8d30c7d3c80bbf1bf6
SSDEEP

12288:FoQEv3hQfcDIwXIIpxrQqR+2PwETiTyGftIjFSuuWEjSfKj+2VaHjdjHp88WbdOT:Fuv3hQfcDIwXIMxr3R+2IETiTyGFI1xe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	5100	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 5100	4136	rundll32.exe	81
PID 4136 wrote to memory of 5100	4136	rundll32.exe	81
PID 4136 wrote to memory of 5100	4136	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Game.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Game.dll,#1
  2⤵
  PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 600
    3⤵
    - Program crash
    PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5100 -ip 5100
1⤵
PID:5012