4dffdab75bb1ab9040081179720bb087eb75fa4844ac77eee6a3f325a0ad937f

Analysis

max time kernel
142s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 20:16

Target

Forza Horizon 2 Inst/Bin/freeimage.dll
Size

5.4MB
MD5

be2b6e27423c65995a8cc8e857f73443
SHA1

1fc316e86ea7b1395aa764988d3424cf5c9f9206
SHA256

89fd43de843308a6f8b89573467f8facd65960e9d3fe57c536760059a1d4e0d4
SHA512

97089423625b1a234e55bb73a0f573fb423468a2a86293fce92a6f88c48856fab3a217cc07306b3c176f8dd849412828c1c54b2441cbc8985d2c22154aeaf9ec
SSDEEP

49152:Ghd0HhgBfznpmSWmQ0c28aE08eRbxocctahCEHqTTavB/cVrHM4GRlKsU:GhdegB7nS0PXCIq6yslK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4396	4100	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4100	2412	rundll32.exe	86
PID 2412 wrote to memory of 4100	2412	rundll32.exe	86
PID 2412 wrote to memory of 4100	2412	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Bin\freeimage.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Bin\freeimage.dll",#1
  2⤵
  PID:4100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 612
    3⤵
    - Program crash
    PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4100 -ip 4100
1⤵
PID:4800