74f311e5b621699555632cd76143b9569a02837d2d8c6a298b7417350ef84346

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 17:30

Target

binaries/steam_api64.dll
Size

135KB
MD5

8b94f89dbc5dfa9f4e59b860cded9f5d
SHA1

d3f392c5f20ce1bcbf13c3c6f770ca62c3501afd
SHA256

e545574b59309bd11b519aef94b08ee62ba794037e28ef8c2a95021307e24154
SHA512

0da19b72633fff3a3d069d6f1d70f65243ae401c3de5414a95d8de60659d777366da623cba14dea1d72dddf3ff6b0d5cda798c3c47a88e8d8912224fd692770f
SSDEEP

3072:f8TaJf5llFFPyN++ebUIIC0lBnZBWvrN1kfVF:f8eFNnyBC07nLfV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2856	2616	rundll32.exe	28
PID 2616 wrote to memory of 2856	2616	rundll32.exe	28
PID 2616 wrote to memory of 2856	2616	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\binaries\steam_api64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2616 -s 116
  2⤵
  PID:2856

memory/2616-0-0x000007FEF77B0000-0x000007FEF7801000-memory.dmp

Filesize
324KB

Download
memory/2616-2-0x000007FEBD630000-0x000007FEBD640000-memory.dmp

Filesize
64KB

Download
memory/2616-1-0x000007FEF7750000-0x000007FEF77A1000-memory.dmp

Filesize
324KB

Download
memory/2616-3-0x000007FEF77B0000-0x000007FEF7801000-memory.dmp

Filesize
324KB

Download
memory/2616-4-0x000007FEF7750000-0x000007FEF77A1000-memory.dmp

Filesize
324KB

Download
memory/2616-7-0x000007FEF77B0000-0x000007FEF7801000-memory.dmp

Filesize
324KB

Download