bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650

Analysis

max time kernel
119s
max time network
147s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 12:59

Target

Among Us v2022.12.14i-Pivigames.blog/Among Us_Data/Plugins/x86/EOSSDK-Win32-Shipping.dll
Size

17.4MB
MD5

219c212b35a8ec54f37331c907949137
SHA1

6b044162117f3cd99dc23d01d06b26cce5d18a1f
SHA256

e9bdd39b7ac4feed0415b7d8a27f1c44ac12c0e7631acedd66fcfcaddff347e1
SHA512

c9568e9678975a97c551b6660fec60a9595840fd258f122c84e5dd59fa40a794ac874a5ba93fc58933b2e858675ecfd4afb7ccf61412122cd2839e9497d63192
SSDEEP

393216:MznQmtTBwebeZcFPDC4QTPPdmmw7OHr+7v/3H:MTNPw5TP8v/3H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	2932	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2932	2484	rundll32.exe	30
PID 2484 wrote to memory of 2932	2484	rundll32.exe	30
PID 2484 wrote to memory of 2932	2484	rundll32.exe	30
PID 2484 wrote to memory of 2932	2484	rundll32.exe	30
PID 2484 wrote to memory of 2932	2484	rundll32.exe	30
PID 2484 wrote to memory of 2932	2484	rundll32.exe	30
PID 2484 wrote to memory of 2932	2484	rundll32.exe	30
PID 2932 wrote to memory of 2876	2932	rundll32.exe	31
PID 2932 wrote to memory of 2876	2932	rundll32.exe	31
PID 2932 wrote to memory of 2876	2932	rundll32.exe	31
PID 2932 wrote to memory of 2876	2932	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\Plugins\x86\EOSSDK-Win32-Shipping.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\Plugins\x86\EOSSDK-Win32-Shipping.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 284
    3⤵
    - Program crash
    PID:2876