0355475b500f6df818c7fdb5516def6b030e6ef663aea8fc372f0e290ef22e7c

Analysis

max time kernel
54s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 15:39

Target

(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/d3d9.dll
Size

2.5MB
MD5

dccf60763ed446767366f9cb6517e1c1
SHA1

352d8dd56c65aaeee70b988fd81d9a1271874da9
SHA256

a9c4ae72f0b1747819b91fffa4a711d2c4ed7021b498dd20b6d1962a00423321
SHA512

1a954068b47bc018f38af5cf78f6a738e0dd89f7b9774e58c2034f1577a199559614dbab347b28e6f0079908d17d9cbb8027470a986fa87e0c83dafd391f2957
SSDEEP

49152:qONcDC1rLa1kV5PolK55cWK7wGqAKfSTHChnu11narbsO+3lTfdMBc2EN+tlOsd8:qONSCa1YglY5Z2o9SV5avsvdMBO

Score

1^/10

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 3724	4124	rundll32.exe	84
PID 4124 wrote to memory of 3724	4124	rundll32.exe	84
PID 4124 wrote to memory of 3724	4124	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\d3d9.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\d3d9.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724

memory/3724-0-0x0000000077030000-0x0000000077120000-memory.dmp

Filesize
960KB

Download
memory/3724-1-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/3724-3-0x0000000077030000-0x0000000077120000-memory.dmp

Filesize
960KB

Download
memory/3724-4-0x0000000077030000-0x0000000077120000-memory.dmp

Filesize
960KB

Download