41b8165de1e508ec34a889a371e0dd75d888f8530e20279af046871d25742ced

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 07:55

Target

Plants.Vs.Zombies.GOTY/Plants Vs Zombies GOTY/Plants vs. Zombies/Core/QtCore4.dll
Size

2.6MB
MD5

cbbf60bb2e51f8145ce69ad9ab769a90
SHA1

291e746ece0d0b28c3b450feb5bdbcbea02dbba3
SHA256

f356cded1ef08d8c99860db2fe19598a55d762b510c1c89fb3f33b46f602d7c2
SHA512

74224fd37a619c6de8d510d1176212e050a99183105dd0adc46b3b61bf9d1fbf7261fd3df6299630751d2f49fe18d6e1d6efe12aa12068447fd5be413bef7ffa
SSDEEP

49152:9pnyb0Z+zbpGbmiL465RJ6e6GJsv6tWKFdu9CFTSuuFMr:9NyxG1tPs+Jsv6tWKFdu9Cm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2768	2720	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2720	1764	rundll32.exe	28
PID 1764 wrote to memory of 2720	1764	rundll32.exe	28
PID 1764 wrote to memory of 2720	1764	rundll32.exe	28
PID 1764 wrote to memory of 2720	1764	rundll32.exe	28
PID 1764 wrote to memory of 2720	1764	rundll32.exe	28
PID 1764 wrote to memory of 2720	1764	rundll32.exe	28
PID 1764 wrote to memory of 2720	1764	rundll32.exe	28
PID 2720 wrote to memory of 2768	2720	rundll32.exe	30
PID 2720 wrote to memory of 2768	2720	rundll32.exe	30
PID 2720 wrote to memory of 2768	2720	rundll32.exe	30
PID 2720 wrote to memory of 2768	2720	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Plants.Vs.Zombies.GOTY\Plants Vs Zombies GOTY\Plants vs. Zombies\Core\QtCore4.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Plants.Vs.Zombies.GOTY\Plants Vs Zombies GOTY\Plants vs. Zombies\Core\QtCore4.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 240
    3⤵
    - Program crash
    PID:2768