0355475b500f6df818c7fdb5516def6b030e6ef663aea8fc372f0e290ef22e7c

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 15:39

Target

(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/scripts/DebugOpts.dll
Size

12KB
MD5

883d4ab7fd62eb2d07ec3f6d53d7a36e
SHA1

3da2f78a8da9f245df32f7c2ab68058f269b16bd
SHA256

b0c691581182d7c132efe68fc43612aebe924e7df67bdf49e2a1b9e8ef17f6eb
SHA512

e9697eafb592b78af9b1bd37a7e043985406eb6f7216b2a1e18038ca53b54d555c4f86f5e77a2d562d39b6bd4fe513998eafc391d515bdcdb85144a1aacdb71a
SSDEEP

192:f6ebuaIeTmLIcsZjB0N5DXEGZpQeCA+mBBeGkO7NtPHnoz63Iy:SebuaIeTmLIWbEGTQexBsGkO7jnQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3596	960	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 960	4892	rundll32.exe	84
PID 4892 wrote to memory of 960	4892	rundll32.exe	84
PID 4892 wrote to memory of 960	4892	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\scripts\DebugOpts.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\scripts\DebugOpts.dll",#1
  2⤵
  PID:960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 540
    3⤵
    - Program crash
    PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 960 -ip 960
1⤵
PID:2520