fbae68a26f20150a540f528586f8bd47e5eadac3b111995da5e77746305f145d

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/12/2023, 18:20

Target

tf2hud-editor/PresentationNative_cor3.dll
Size

1.2MB
MD5

370b4aa0e23435e8e7c1b9111b7c59b5
SHA1

bed868e0d5d689c84a07f8f9c4b6e3ed7abec917
SHA256

43fbf2ec1c311d0b1785a8f93557ced67ce1bd956cf229aa466d5aee8f53fdb3
SHA512

2cb8d54ce49fd3c8622bc073d5614406b05a9a79521d80d0317036596c157eb4435a8dfa469b75bd61d96fec5ca4b3ebc212e25913e89ba755fbf0a217c250de
SSDEEP

24576:vidO8pkxmHUm6KDILQmkCESLSPJL/AliNzdPw9cM+D/H+VHFpYpWwxzRNDDb:vP8pkgUm6Kq9zLSPlAlgxPw9w/H+xYp9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2324	2396	rundll32.exe	28
PID 2396 wrote to memory of 2324	2396	rundll32.exe	28
PID 2396 wrote to memory of 2324	2396	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\PresentationNative_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2396 -s 112
  2⤵
  PID:2324