4dffdab75bb1ab9040081179720bb087eb75fa4844ac77eee6a3f325a0ad937f

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 20:16

Target

Forza Horizon 2 Inst/Direct3D.dll
Size

86KB
MD5

2436d0e6b87f8a4f43352d10891bc7c8
SHA1

db100aa3eb42c423541f50fdd45737b7d7805f0c
SHA256

ce4523241c8e6404d56cdaad5cc8d85dc732c8874d20cbe7ed77c16ec18859bc
SHA512

cfc61c503b0ba2815c448e3d84021691516445086917bc3d65a248124339b6e1dad4aaee36a0bce93492fb71e03a7442b3d69847e3b8921f9d651179a94b2d04
SSDEEP

1536:UbZH3eyO6qe1VUROqK3CwenA45PI8JL9bkIeHCCBBpW+s8nBscP1u3YCCCR+CbyB:Krqe1aXK3ClI8zeHwcP1iP0Ci

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3552	2272	rundll32.exe	83
PID 2272 wrote to memory of 3552	2272	rundll32.exe	83
PID 2272 wrote to memory of 3552	2272	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Direct3D.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Direct3D.dll",#1
  2⤵
  PID:3552