85c9b01515c4f19f797d8753d7187f463b3c742012bd22d3ea84c222ea7f5a76

Analysis

max time kernel
90s
max time network
80s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19-09-2023 06:51

Target

MultiMC/libLauncher_quazip.dll
Size

313KB
MD5

8eefe03d3897acf1c470197676c6e460
SHA1

03f8bbf661d468719d2bcb8f923416acc72397ce
SHA256

ce2d399a65af4a02aef7ec144643c4a104933ccbed859cd47bc6fad908aeffdb
SHA512

5373a43e59f9d9806803e7db02bf5099f2b3c45c7fe89cc06ac7f8d0b0fefac18654f8f0ff94f4955fc80ddc28c44531d65172cea9ceddc314db671b0d368051
SSDEEP

6144:v2GqFejo44ffwqGOIq/2cPWt8RJhywVapRwT5yM:BqFBF0OhDT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
192	2872	WerFault.exe	70

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2872	1816	rundll32.exe	70
PID 1816 wrote to memory of 2872	1816	rundll32.exe	70
PID 1816 wrote to memory of 2872	1816	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\libLauncher_quazip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\libLauncher_quazip.dll,#1
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 684
    3⤵
    - Program crash
    PID:192

memory/2872-0-0x0000000004790000-0x0000000004CBF000-memory.dmp

Filesize
5.2MB

Download
memory/2872-5-0x0000000004790000-0x0000000004CBF000-memory.dmp

Filesize
5.2MB

Download
memory/2872-7-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/2872-8-0x0000000004790000-0x0000000004CBF000-memory.dmp

Filesize
5.2MB

Download
memory/2872-9-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/2872-10-0x0000000061B80000-0x0000000061B98000-memory.dmp

Filesize
96KB

Download
memory/2872-11-0x0000000068AC0000-0x0000000068ACC000-memory.dmp

Filesize
48KB

Download
memory/2872-12-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/2872-13-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/2872-14-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download