03088cc439c38d55bd53b342656942f2c756ccd4a59a1fbb55912c0db11fe193 | Triage

Analysis

max time kernel
120s
max time network
55s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Playnite.DesktopApp.exe
Size

2.4MB
MD5

bed5860621f125f2c111da4026881775
SHA1

681632b14c598f09b5e0389889b21bac4c7d3a42
SHA256

03088cc439c38d55bd53b342656942f2c756ccd4a59a1fbb55912c0db11fe193
SHA512

2ec87d914855fe248f8cc5473f3167311e87c51ac31fdb099dee8ba2ed4884e5b3c5c4bc95b7c47ae507f9abbcd34b34d09affd8af0be77e5acf24504a827d83
SSDEEP

49152:FaLxHQMICCSEAZ48bfPVHYHnu26XBGL4Y2viwnBzevemX2C/v:Fajup2qR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	2600	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2352	2600	Playnite.DesktopApp.exe	28
PID 2600 wrote to memory of 2352	2600	Playnite.DesktopApp.exe	28
PID 2600 wrote to memory of 2352	2600	Playnite.DesktopApp.exe	28
PID 2600 wrote to memory of 2352	2600	Playnite.DesktopApp.exe	28

C:\Users\Admin\AppData\Local\Temp\Playnite.DesktopApp.exe
"C:\Users\Admin\AppData\Local\Temp\Playnite.DesktopApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 540
  2⤵
  - Program crash
  PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-0-0x0000000074BC0000-0x00000000752AE000-memory.dmp

Filesize
6.9MB

Download
memory/2600-1-0x0000000000C30000-0x0000000000E92000-memory.dmp

Filesize
2.4MB

Download
memory/2600-2-0x0000000074BC0000-0x00000000752AE000-memory.dmp

Filesize
6.9MB

Download