661a4c00825cee7ee2693eafbe77e6876e70147b47bc6c62e53e7c97136937b4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 23:35

Target

3DM4.83/3DM NBA2K12 MOD工具.net4.exe
Size

121KB
MD5

41b5cfe24b64835730c539417eace349
SHA1

781c98af95849862d03e7e9bc0cab9969a20295b
SHA256

d309e96cdcf8bdddb4f4552eaf5c1ad444cf3e208d18e385cfa8fa0332f6b213
SHA512

98a5c8e7b386ddda0de14fe22de2d614e44644851b9810466f950ef9738534fb4a5295f25fb07e39a33cb2d68c96b5a048a40154558c9675437b50d5521126d2
SSDEEP

1536:dNVOng6RcoAF8y2ctoZP3cxR3+huCKHsfd9+0U/8l3+:dWngOc2Yo5aR3+hulsF9+0U/8l3+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	1720	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2892	1720	3DM NBA2K12 MOD工具.net4.exe	28
PID 1720 wrote to memory of 2892	1720	3DM NBA2K12 MOD工具.net4.exe	28
PID 1720 wrote to memory of 2892	1720	3DM NBA2K12 MOD工具.net4.exe	28
PID 1720 wrote to memory of 2892	1720	3DM NBA2K12 MOD工具.net4.exe	28

C:\Users\Admin\AppData\Local\Temp\3DM4.83\3DM NBA2K12 MOD工具.net4.exe
"C:\Users\Admin\AppData\Local\Temp\3DM4.83\3DM NBA2K12 MOD工具.net4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 604
  2⤵
  - Program crash
  PID:2892

memory/1720-0-0x0000000000A90000-0x0000000000AB4000-memory.dmp

Filesize
144KB

Download
memory/1720-1-0x0000000074B70000-0x000000007525E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-2-0x0000000000840000-0x0000000000855000-memory.dmp

Filesize
84KB

Download
memory/1720-3-0x0000000074B70000-0x000000007525E000-memory.dmp

Filesize
6.9MB

Download