0355475b500f6df818c7fdb5516def6b030e6ef663aea8fc372f0e290ef22e7c

Analysis

max time kernel
7s
max time network
42s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-08-2023 15:39

Target

(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/d3d9.dll
Size

2.5MB
MD5

dccf60763ed446767366f9cb6517e1c1
SHA1

352d8dd56c65aaeee70b988fd81d9a1271874da9
SHA256

a9c4ae72f0b1747819b91fffa4a711d2c4ed7021b498dd20b6d1962a00423321
SHA512

1a954068b47bc018f38af5cf78f6a738e0dd89f7b9774e58c2034f1577a199559614dbab347b28e6f0079908d17d9cbb8027470a986fa87e0c83dafd391f2957
SSDEEP

49152:qONcDC1rLa1kV5PolK55cWK7wGqAKfSTHChnu11narbsO+3lTfdMBc2EN+tlOsd8:qONSCa1YglY5Z2o9SV5avsvdMBO

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2912	2936	rundll32.exe	30
PID 2936 wrote to memory of 2912	2936	rundll32.exe	30
PID 2936 wrote to memory of 2912	2936	rundll32.exe	30
PID 2936 wrote to memory of 2912	2936	rundll32.exe	30
PID 2936 wrote to memory of 2912	2936	rundll32.exe	30
PID 2936 wrote to memory of 2912	2936	rundll32.exe	30
PID 2936 wrote to memory of 2912	2936	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\d3d9.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\d3d9.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912

memory/2912-0-0x00000000763A0000-0x00000000764B0000-memory.dmp

Filesize
1.1MB

Download
memory/2912-1-0x00000000763A0000-0x00000000764B0000-memory.dmp

Filesize
1.1MB

Download
memory/2912-3-0x00000000763A0000-0x00000000764B0000-memory.dmp

Filesize
1.1MB

Download
memory/2912-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2912-5-0x00000000763A0000-0x00000000764B0000-memory.dmp

Filesize
1.1MB

Download