41b8165de1e508ec34a889a371e0dd75d888f8530e20279af046871d25742ced

Analysis

max time kernel
117s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 07:55

Target

Plants.Vs.Zombies.GOTY/Plants Vs Zombies GOTY/Plants vs. Zombies/Core/QtGui4.dll
Size

9.0MB
MD5

886cefa51c9671be520a6a60544e4d7f
SHA1

a69731c6f635fc1ae50d6d21b360834b8ff67aa5
SHA256

1be9a3031f8e488cd5839a7b74641d6e758fbde4d28eb09bc4cf892e2edd0a38
SHA512

b635a41b6957c07404b4ced039d5f0cf80bb344b9d006b8bf4abe7af61b83885d9dd53dac8c1cc0ecae4f4f6bd77dc9af9a35220d112d2b8dbc94266b0809b56
SSDEEP

98304:1xvQeZgQinV7IgyL9d/loEDLGDCNfG/9WJghBeZJ9xDKcrSF/n8CWyE5Vafed:1xlZFRlDKDCNfU9WJJHKc2wa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2668	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2668	3008	rundll32.exe	28
PID 3008 wrote to memory of 2668	3008	rundll32.exe	28
PID 3008 wrote to memory of 2668	3008	rundll32.exe	28
PID 3008 wrote to memory of 2668	3008	rundll32.exe	28
PID 3008 wrote to memory of 2668	3008	rundll32.exe	28
PID 3008 wrote to memory of 2668	3008	rundll32.exe	28
PID 3008 wrote to memory of 2668	3008	rundll32.exe	28
PID 2668 wrote to memory of 2264	2668	rundll32.exe	29
PID 2668 wrote to memory of 2264	2668	rundll32.exe	29
PID 2668 wrote to memory of 2264	2668	rundll32.exe	29
PID 2668 wrote to memory of 2264	2668	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Plants.Vs.Zombies.GOTY\Plants Vs Zombies GOTY\Plants vs. Zombies\Core\QtGui4.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Plants.Vs.Zombies.GOTY\Plants Vs Zombies GOTY\Plants vs. Zombies\Core\QtGui4.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 288
    3⤵
    - Program crash
    PID:2264