74f311e5b621699555632cd76143b9569a02837d2d8c6a298b7417350ef84346

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 17:30

Target

binaries/steam_api64_org_launcher.dll
Size

244KB
MD5

2a09ae29b5613645a4b30e9deea68042
SHA1

e77433094c56433685a68a4436e81b76c3b5e1f5
SHA256

b8246e1a629b945fe526b24c3e4f002c4f6eb86aa1b5ed9744399f22a0d2ca9f
SHA512

9f7cfbd07e8d1c376ad2247d1b356a557e4f799c77866838152b2bea43cb71ae3c9bf88e9ba7dee22c7f15d212473de9de97ab9af32003d1f802763f3ff4bc8b
SSDEEP

3072:3NLHFM+SkIWjKSEW6p0TPj3pAoSQp5doyF/OHy7+HytNICJxHnNJQcLRaz:pHi+SVWSZp0TL59SQH2KKyoCJlNJtE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2208	2324	rundll32.exe	28
PID 2324 wrote to memory of 2208	2324	rundll32.exe	28
PID 2324 wrote to memory of 2208	2324	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\binaries\steam_api64_org_launcher.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2324 -s 116
  2⤵
  PID:2208