0c21133a8b332f0462ae88430a615fce1447cc49f8b18fee274baa64b6d0c8cd

Analysis

max time kernel
148s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
17-02-2024 05:28

Target

UltimMC/libLauncher_nbt++.dll
Size

342KB
MD5

c87356b6155e4dd9c44d8165b6bfd091
SHA1

ddc34aa1be67d7bdf0d130be35f12652f1130006
SHA256

01552943628e3525722e81e43b4a175c398cd462fa6c2216443cb18911f8186b
SHA512

77ac7805aa6a7f7df463310199adf19a8ae5748d1fc36546f552ead32252df04db99979c0aae2db6e2e31e4130cf8771a61f79932d5d3891e09dbb0c4d8cf3e5
SSDEEP

6144:+IUgcH0hz6J8UOxWbc5sCDPB/Qll7a56FBTYb4Y7pHhW6dJjgGoo5Nheff1ByLca:+IUgcH0h1V/Qll7W

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3128 3028 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3128	3028	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4288 wrote to memory of 3028	4288	rundll32.exe	rundll32.exe
PID 4288 wrote to memory of 3028	4288	rundll32.exe	rundll32.exe
PID 4288 wrote to memory of 3028	4288	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_nbt++.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4288

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_nbt++.dll,#1
2⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 480
3⤵
- Program crash
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3028 -ip 3028
1⤵
PID:236

memory/3028-0-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/3028-1-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/3028-5-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/3028-6-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download
memory/3028-4-0x0000000068AC0000-0x0000000068ACC000-memory.dmp

Filesize
48KB

Download
memory/3028-3-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download