c32550c087e49d116d1152bd1b709739e2d9bbfad72c66d1fbe9ccdf38b87524

Analysis

max time kernel
5s
max time network
3s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/07/2023, 17:04

Target

gmcl_joystick_win64.dll
Size

102KB
MD5

61b432406d48b18b0b7a81e4c9f06053
SHA1

bc3534547fb83b624e14d890df932ced8f20ae82
SHA256

c32550c087e49d116d1152bd1b709739e2d9bbfad72c66d1fbe9ccdf38b87524
SHA512

3a02f0065301978f2bdbdb171c2706aaee24c6ee02e132fc1ab8b693d9bad040d8b82ae5f496da03937db8062f8835b0fa46043eea483a6d80cb87914ee4168a
SSDEEP

1536:A/H+TkSAfJJHU4SKsSuV9Z+FZVU0Ab0v6XMsWyd09dlyaBHH33VRt:sHUkSAf/UEsHV/+FZVU0lCXdM0Azt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	2328	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2328	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2316	2328	rundll32.exe	28
PID 2328 wrote to memory of 2316	2328	rundll32.exe	28
PID 2328 wrote to memory of 2316	2328	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gmcl_joystick_win64.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2328 -s 104
  2⤵
  - Program crash
  PID:2316