65d38305a8b68c0a00cb7133612777acd4cc9f4c2e770cf4adbf392172a32227

Resubmissions

18-07-2023 14:28

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 14:28

Target

GameAssembly.dll
Size

17.0MB
MD5

18104a476685582fa374bdf4cd8756b5
SHA1

b95e0c25707a522d4749888ac6415e8a7826080d
SHA256

6c35f2a0db92f4530f7f1c410da069400f2525b17b44bdc9637f68463cfc7b43
SHA512

192f82082079715a3488668bb8e6a09bc50885f48048e7d328cb727acfa2b241eed7b212ed97409c93c060a574a3decf59f5dbc87f186bc663899076b1bccf51
SSDEEP

196608:Dpb9YOta6Kfe1gQi5LTdMGYt/xIoto6ZZSQMdSVGnbfGPd4zD:DJta6Kfe1gQgLWGA/xIotoOrMsVGqa

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2464 1716 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2464	1716	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1716 wrote to memory of 2464	1716	rundll32.exe	WerFault.exe
PID 1716 wrote to memory of 2464	1716	rundll32.exe	WerFault.exe
PID 1716 wrote to memory of 2464	1716	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GameAssembly.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1716 -s 264
  2⤵
  - Program crash
  PID:2464