735eda92258a85f598eb9302fdd132f3256eacf6c8473ef152d529b23b4fe722

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 12:01

Target

HLMV_standalone/bin/wxmsw312u_gl_vc_custom.dll
Size

87KB
MD5

ab7109ac41f975cccb46db02c6c6aab5
SHA1

59cfc7cedc6882df2f1d7f469a9b330c89be4f9a
SHA256

8c8feaedd03aaf2efb50e9340ba0cbc893b54a08e9aedd11f981c1496045e558
SHA512

709b8a97f5abb09b26c6f66de4abb3693335b411929a1e39006722f28e3c1f7a3aa7270ed041e2461e73ccb09106cd5531221bdaeeae2c012259b2ae8b484b0b
SSDEEP

1536:3aV4cemHbet13VsA3GbZyNGduKdnQPS5CcEQX8xa7BsSWugZ6YTy7:qVwTsAWboYduYQPS5CcEQX8GsSWugZTm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	1696	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1696	2220	rundll32.exe	28
PID 2220 wrote to memory of 1696	2220	rundll32.exe	28
PID 2220 wrote to memory of 1696	2220	rundll32.exe	28
PID 2220 wrote to memory of 1696	2220	rundll32.exe	28
PID 2220 wrote to memory of 1696	2220	rundll32.exe	28
PID 2220 wrote to memory of 1696	2220	rundll32.exe	28
PID 2220 wrote to memory of 1696	2220	rundll32.exe	28
PID 1696 wrote to memory of 2452	1696	rundll32.exe	29
PID 1696 wrote to memory of 2452	1696	rundll32.exe	29
PID 1696 wrote to memory of 2452	1696	rundll32.exe	29
PID 1696 wrote to memory of 2452	1696	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HLMV_standalone\bin\wxmsw312u_gl_vc_custom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HLMV_standalone\bin\wxmsw312u_gl_vc_custom.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 288
    3⤵
    - Program crash
    PID:2452