8c42f9674ff816931c14278d1180bf87ce453d308994ef1673ad32a96475caa5

Analysis

max time kernel
415s
max time network
421s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28-07-2023 13:15

Target

UltimMC/libLauncher_rainbow.dll
Size

67KB
MD5

ac9869b0e1db5118998f1b90766a35fb
SHA1

16c8521c5d8ea1531453fa5797af71d1260568b5
SHA256

546db0cf1cda62bb82d8f0ebfcc07b5c574a8ce827d1eb6106d622e2457829f7
SHA512

9e7dd1b4aa27c984df394f53297fa93521feeaf9b461640a74354a569ab85168abadbc0aac3413a6d991b69a44345235ea87a7990c9117d8e26a49d0256532a2
SSDEEP

768:nEg24DKoyYH150BEexXfz2xGppy/a2MaOtRd9P9mg8rO71:nFVD11ij1oDM5hP7x

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

436 3412 WerFault.exe rundll32.exe

pid	pid_target	process	target process
436	3412	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3428 wrote to memory of 3412	3428	rundll32.exe	rundll32.exe
PID 3428 wrote to memory of 3412	3428	rundll32.exe	rundll32.exe
PID 3428 wrote to memory of 3412	3428	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_rainbow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_rainbow.dll,#1
2⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 676
3⤵
- Program crash
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3412 -ip 3412
1⤵
PID:2032

memory/3412-133-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download
memory/3412-134-0x0000000063400000-0x0000000063415000-memory.dmp

Filesize
84KB

Download
memory/3412-135-0x0000000061940000-0x0000000061EB5000-memory.dmp

Filesize
5.5MB

Download
memory/3412-139-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download
memory/3412-140-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/3412-141-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/3412-142-0x0000000001050000-0x000000000105C000-memory.dmp

Filesize
48KB

Download