4dffdab75bb1ab9040081179720bb087eb75fa4844ac77eee6a3f325a0ad937f

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16-07-2023 20:16

Target

Forza Horizon 2 Inst/Bin/freeimage.dll
Size

5.4MB
MD5

be2b6e27423c65995a8cc8e857f73443
SHA1

1fc316e86ea7b1395aa764988d3424cf5c9f9206
SHA256

89fd43de843308a6f8b89573467f8facd65960e9d3fe57c536760059a1d4e0d4
SHA512

97089423625b1a234e55bb73a0f573fb423468a2a86293fce92a6f88c48856fab3a217cc07306b3c176f8dd849412828c1c54b2441cbc8985d2c22154aeaf9ec
SSDEEP

49152:Ghd0HhgBfznpmSWmQ0c28aE08eRbxocctahCEHqTTavB/cVrHM4GRlKsU:GhdegB7nS0PXCIq6yslK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2412	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2412	2100	rundll32.exe	28
PID 2100 wrote to memory of 2412	2100	rundll32.exe	28
PID 2100 wrote to memory of 2412	2100	rundll32.exe	28
PID 2100 wrote to memory of 2412	2100	rundll32.exe	28
PID 2100 wrote to memory of 2412	2100	rundll32.exe	28
PID 2100 wrote to memory of 2412	2100	rundll32.exe	28
PID 2100 wrote to memory of 2412	2100	rundll32.exe	28
PID 2412 wrote to memory of 2364	2412	rundll32.exe	29
PID 2412 wrote to memory of 2364	2412	rundll32.exe	29
PID 2412 wrote to memory of 2364	2412	rundll32.exe	29
PID 2412 wrote to memory of 2364	2412	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Bin\freeimage.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Bin\freeimage.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 224
    3⤵
    - Program crash
    PID:2364