95acc4d1a274dd2edf1755278413d6d9e5e6485ade610a571c772e98c0fd30a1

Analysis

max time kernel
136s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231222-es
resource tags

arch:x64arch:x86image:win10v2004-20231222-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
12/01/2024, 10:11

Target

DISTRAINT.v06.12.16-PiviGames.blog/steam_api.dll
Size

803KB
MD5

2f4a9213780fd351865af0c447212185
SHA1

2b50503d8df91ab41e623bb680d99103854a717b
SHA256

2e799090865407f6b507453849be0ca62351f5b72a8664bc00cc5e6cb3de5f02
SHA512

9e82f9f595c14f3f1d229e3afc470f6db07c13edced0d68e7f2dbdf59b27e3ebb4f22372f4899c83e29e63c4cb4bef3717040a83133554e8102e3114b78278eb
SSDEEP

24576:RRPsQGTCqvllA9VYQndskfEQeE+EInMPbc:jaCqdlAdFEkIQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	3304	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 3304	3640	rundll32.exe	87
PID 3640 wrote to memory of 3304	3640	rundll32.exe	87
PID 3640 wrote to memory of 3304	3640	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DISTRAINT.v06.12.16-PiviGames.blog\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DISTRAINT.v06.12.16-PiviGames.blog\steam_api.dll,#1
  2⤵
  PID:3304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 636
    3⤵
    - Program crash
    PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3304 -ip 3304
1⤵
PID:3704

memory/3304-0-0x00000000746B0000-0x000000007538F000-memory.dmp

Filesize
12.9MB

Download
memory/3304-1-0x00000000746B0000-0x000000007538F000-memory.dmp

Filesize
12.9MB

Download
memory/3304-4-0x00000000746B0000-0x000000007538F000-memory.dmp

Filesize
12.9MB

Download