dd539ceadfb96034785a578eda7f1fb4fa6b03b7a3cded025b4c553ba618a864

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 01:11

Target

Five Nights At Shrets Hotel 2 - V2.0 - Win x64/Five Nights At Shreks Hotel 2 (Official)_Data/Plugins.dll
Size

356KB
MD5

6ae66c5517013f4a95258debc62a8611
SHA1

e7c235d8ff65b6b1d103c2a64e0d35ba2b237d19
SHA256

2fc8ce5e43d1e8ddaffffd41f7945094dcf2503326f53763fc78b716f29789e1
SHA512

454b03fa86c98fb9789ec2b1ed80bb37b4257044826c35feae3138cdd482a892eb4c670d75c77036a7ae0f801685e836716b75f905884ea5f4b763120027932c
SSDEEP

6144:0zvu07lPcO6vz/vPi1O4z7+aNUJUGkED+zsMuZ2JV3Vf/WeN:Kvu6PcVPi1jz7+aNUJUXtQMV3NWeN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2992	1420	rundll32.exe	28
PID 1420 wrote to memory of 2992	1420	rundll32.exe	28
PID 1420 wrote to memory of 2992	1420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Five Nights At Shrets Hotel 2 - V2.0 - Win x64\Five Nights At Shreks Hotel 2 (Official)_Data\Plugins.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1420 -s 80
  2⤵
  PID:2992