0355475b500f6df818c7fdb5516def6b030e6ef663aea8fc372f0e290ef22e7c

Analysis

max time kernel
122s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 15:39

Target

(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/scripts/NFSUHDReflections.dll
Size

244KB
MD5

dc48f70b0b795ccc7a914e599af82f4e
SHA1

ed1debff763654ed10d0d30f85b17959aaddab8a
SHA256

f28872597f19a3f3658efcfc075a53d8e2f11bb1fc4b2766631326ee2750b7b3
SHA512

a1337a0a37c4eae43977c31fd0961acf16747d52bb590bf085547c8cb09d746c473a662e78333f8df37778eb84cff5bf5a4a283879d93104032c403c69459053
SSDEEP

6144:5b8SFSxP8jUrn74pfW1+gLdwfCfSgKJuJuzUaAfBAOd3uv:5bEGjUrnMZW1+g1/KJuJuzUvpuv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4016	3648	rundll32.exe	87
PID 3648 wrote to memory of 4016	3648	rundll32.exe	87
PID 3648 wrote to memory of 4016	3648	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\scripts\NFSUHDReflections.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\scripts\NFSUHDReflections.dll",#1
  2⤵
  PID:4016