c15427a19da1db7b3f9e9544db6eceae3fc30c42d570fa8d56728db6cd6c5c22

Analysis

max time kernel
127s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2023, 08:44

Target

Bread.and.Fred-GoldBerg/Bread&Fred_Data/Plugins/x86/Rewired_DirectInput.dll
Size

11KB
MD5

df2d34b16ceb8b76544c1e1446424337
SHA1

a076a9d6d1e61b4b3b688e672d14a654a9a05d86
SHA256

ffdfcb31d713ab4b6d196e598d2112e8abe39499491ab1fda2a172a6c42efdb9
SHA512

e2b4410f3613862084551dff971b75d5a5cecee4ecf139b6efc2ade6d20c8ffc395f650b71d707b065a25c9a519a03155c7ae79b26de2352a858702f1827c046
SSDEEP

96:DAPG3jk/eYe6Qv7tw+iUg3CehJA63b2KAcY0D1LzEvNdp/Es3QQe9pjx7:DAPGTkRzGS+XgyyJlxgEzGrp/EtH9ph

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5116	1972	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1972	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 1972	5108	rundll32.exe	84
PID 5108 wrote to memory of 1972	5108	rundll32.exe	84
PID 5108 wrote to memory of 1972	5108	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bread.and.Fred-GoldBerg\Bread&Fred_Data\Plugins\x86\Rewired_DirectInput.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bread.and.Fred-GoldBerg\Bread&Fred_Data\Plugins\x86\Rewired_DirectInput.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 792
    3⤵
    - Program crash
    PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1972 -ip 1972
1⤵
PID:956