0355475b500f6df818c7fdb5516def6b030e6ef663aea8fc372f0e290ef22e7c

Analysis

max time kernel
18s
max time network
51s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 15:39

Target

(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/dimap.dll
Size

43KB
MD5

82d285f793ebc6e497d69df720a457f6
SHA1

82effd71b9873d02623c9a9d93958c5f08decb9f
SHA256

0c9f8479a2156147128c336c008c82fb4242a8852af3722114fbb69407c3148c
SHA512

d48bc393be9046ead714b8947f65586bfe6053d6f15939326608585b11bc1ad23cb1fbb48b5d8436386039c4c93252c758a61cd5252f131be186033b8a958ab1
SSDEEP

768:a0GHRCA2m0ufN7JEZWdUOQZZQ4axuAAQXsy7wcP4a3oU9bpb:vnufTEZOUde46/Xsy7wXCoUzb

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2792	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2792	2120	rundll32.exe	27
PID 2120 wrote to memory of 2792	2120	rundll32.exe	27
PID 2120 wrote to memory of 2792	2120	rundll32.exe	27
PID 2120 wrote to memory of 2792	2120	rundll32.exe	27
PID 2120 wrote to memory of 2792	2120	rundll32.exe	27
PID 2120 wrote to memory of 2792	2120	rundll32.exe	27
PID 2120 wrote to memory of 2792	2120	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\dimap.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\dimap.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2792

memory/2792-0-0x0000000076360000-0x0000000076470000-memory.dmp

Filesize
1.1MB

Download
memory/2792-1-0x0000000076360000-0x0000000076470000-memory.dmp

Filesize
1.1MB

Download
memory/2792-2-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2792-3-0x0000000076360000-0x0000000076470000-memory.dmp

Filesize
1.1MB

Download
memory/2792-5-0x0000000076360000-0x0000000076470000-memory.dmp

Filesize
1.1MB

Download