c15427a19da1db7b3f9e9544db6eceae3fc30c42d570fa8d56728db6cd6c5c22

Analysis

max time kernel
118s
max time network
138s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
27/10/2023, 08:44

Target

Bread.and.Fred-GoldBerg/Bread&Fred_Data/Plugins/x86/Rewired_DirectInput.dll
Size

11KB
MD5

df2d34b16ceb8b76544c1e1446424337
SHA1

a076a9d6d1e61b4b3b688e672d14a654a9a05d86
SHA256

ffdfcb31d713ab4b6d196e598d2112e8abe39499491ab1fda2a172a6c42efdb9
SHA512

e2b4410f3613862084551dff971b75d5a5cecee4ecf139b6efc2ade6d20c8ffc395f650b71d707b065a25c9a519a03155c7ae79b26de2352a858702f1827c046
SSDEEP

96:DAPG3jk/eYe6Qv7tw+iUg3CehJA63b2KAcY0D1LzEvNdp/Es3QQe9pjx7:DAPGTkRzGS+XgyyJlxgEzGrp/EtH9ph

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	2136	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2136	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2136	2456	rundll32.exe	28
PID 2456 wrote to memory of 2136	2456	rundll32.exe	28
PID 2456 wrote to memory of 2136	2456	rundll32.exe	28
PID 2456 wrote to memory of 2136	2456	rundll32.exe	28
PID 2456 wrote to memory of 2136	2456	rundll32.exe	28
PID 2456 wrote to memory of 2136	2456	rundll32.exe	28
PID 2456 wrote to memory of 2136	2456	rundll32.exe	28
PID 2136 wrote to memory of 1088	2136	rundll32.exe	29
PID 2136 wrote to memory of 1088	2136	rundll32.exe	29
PID 2136 wrote to memory of 1088	2136	rundll32.exe	29
PID 2136 wrote to memory of 1088	2136	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bread.and.Fred-GoldBerg\Bread&Fred_Data\Plugins\x86\Rewired_DirectInput.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bread.and.Fred-GoldBerg\Bread&Fred_Data\Plugins\x86\Rewired_DirectInput.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 236
    3⤵
    - Program crash
    PID:1088