4dffdab75bb1ab9040081179720bb087eb75fa4844ac77eee6a3f325a0ad937f

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/07/2023, 20:16

Target

Forza Horizon 2 Inst/Direct3D.dll
Size

86KB
MD5

2436d0e6b87f8a4f43352d10891bc7c8
SHA1

db100aa3eb42c423541f50fdd45737b7d7805f0c
SHA256

ce4523241c8e6404d56cdaad5cc8d85dc732c8874d20cbe7ed77c16ec18859bc
SHA512

cfc61c503b0ba2815c448e3d84021691516445086917bc3d65a248124339b6e1dad4aaee36a0bce93492fb71e03a7442b3d69847e3b8921f9d651179a94b2d04
SSDEEP

1536:UbZH3eyO6qe1VUROqK3CwenA45PI8JL9bkIeHCCBBpW+s8nBscP1u3YCCCR+CbyB:Krqe1aXK3ClI8zeHwcP1iP0Ci

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1892	1424	rundll32.exe	28
PID 1424 wrote to memory of 1892	1424	rundll32.exe	28
PID 1424 wrote to memory of 1892	1424	rundll32.exe	28
PID 1424 wrote to memory of 1892	1424	rundll32.exe	28
PID 1424 wrote to memory of 1892	1424	rundll32.exe	28
PID 1424 wrote to memory of 1892	1424	rundll32.exe	28
PID 1424 wrote to memory of 1892	1424	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Direct3D.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 2 Inst\Direct3D.dll",#1
  2⤵
  PID:1892