95acc4d1a274dd2edf1755278413d6d9e5e6485ade610a571c772e98c0fd30a1

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-es
resource tags

arch:x64arch:x86image:win7-20231215-eslocale:es-esos:windows7-x64systemwindows
submitted
12/01/2024, 10:11

Target

DISTRAINT.v06.12.16-PiviGames.blog/steam_api.dll
Size

803KB
MD5

2f4a9213780fd351865af0c447212185
SHA1

2b50503d8df91ab41e623bb680d99103854a717b
SHA256

2e799090865407f6b507453849be0ca62351f5b72a8664bc00cc5e6cb3de5f02
SHA512

9e82f9f595c14f3f1d229e3afc470f6db07c13edced0d68e7f2dbdf59b27e3ebb4f22372f4899c83e29e63c4cb4bef3717040a83133554e8102e3114b78278eb
SSDEEP

24576:RRPsQGTCqvllA9VYQndskfEQeE+EInMPbc:jaCqdlAdFEkIQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	2540	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2540	2236	rundll32.exe	28
PID 2236 wrote to memory of 2540	2236	rundll32.exe	28
PID 2236 wrote to memory of 2540	2236	rundll32.exe	28
PID 2236 wrote to memory of 2540	2236	rundll32.exe	28
PID 2236 wrote to memory of 2540	2236	rundll32.exe	28
PID 2236 wrote to memory of 2540	2236	rundll32.exe	28
PID 2236 wrote to memory of 2540	2236	rundll32.exe	28
PID 2540 wrote to memory of 2416	2540	rundll32.exe	29
PID 2540 wrote to memory of 2416	2540	rundll32.exe	29
PID 2540 wrote to memory of 2416	2540	rundll32.exe	29
PID 2540 wrote to memory of 2416	2540	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DISTRAINT.v06.12.16-PiviGames.blog\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DISTRAINT.v06.12.16-PiviGames.blog\steam_api.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 236
    3⤵
    - Program crash
    PID:2416

memory/2540-0-0x00000000737D0000-0x00000000744AF000-memory.dmp

Filesize
12.9MB

Download
memory/2540-2-0x00000000727C0000-0x000000007349F000-memory.dmp

Filesize
12.9MB

Download
memory/2540-1-0x00000000727C0000-0x000000007349F000-memory.dmp

Filesize
12.9MB

Download
memory/2540-3-0x00000000737D0000-0x00000000744AF000-memory.dmp

Filesize
12.9MB

Download
memory/2540-6-0x00000000727C0000-0x000000007349F000-memory.dmp

Filesize
12.9MB

Download