0355475b500f6df818c7fdb5516def6b030e6ef663aea8fc372f0e290ef22e7c

Analysis

max time kernel
105s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 15:39

Target

(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/dimap.dll
Size

43KB
MD5

82d285f793ebc6e497d69df720a457f6
SHA1

82effd71b9873d02623c9a9d93958c5f08decb9f
SHA256

0c9f8479a2156147128c336c008c82fb4242a8852af3722114fbb69407c3148c
SHA512

d48bc393be9046ead714b8947f65586bfe6053d6f15939326608585b11bc1ad23cb1fbb48b5d8436386039c4c93252c758a61cd5252f131be186033b8a958ab1
SSDEEP

768:a0GHRCA2m0ufN7JEZWdUOQZZQ4axuAAQXsy7wcP4a3oU9bpb:vnufTEZOUde46/Xsy7wXCoUzb

Score

1^/10

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2880	4124	rundll32.exe	60
PID 4124 wrote to memory of 2880	4124	rundll32.exe	60
PID 4124 wrote to memory of 2880	4124	rundll32.exe	60

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\dimap.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\dimap.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880

memory/2880-0-0x0000000075EB0000-0x0000000075FA0000-memory.dmp

Filesize
960KB

Download
memory/2880-1-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/2880-3-0x0000000075EB0000-0x0000000075FA0000-memory.dmp

Filesize
960KB

Download
memory/2880-4-0x0000000075EB0000-0x0000000075FA0000-memory.dmp

Filesize
960KB

Download