a8bc86cd95d9cb31d2a958734e7a88af3eb46bab9a91712a21a7bce6afecde1a

Analysis

max time kernel
69s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
18/02/2024, 08:40

Target

MegaMan Unlimited/vorbisfile.dll
Size

76KB
MD5

4288b1f5a1d63dab449ba64713e4c48b
SHA1

f01757936a44628c0f522652dcdacdfbb93546c6
SHA256

57e903df106eb481c38a72a969fdd5a8c2657b1c495af4c01b62c66f69a46a71
SHA512

2fd8d46cf73e98565ee72a5f3d83a4da077114acd616a5f227e59c166de3a8c4c530c40180cbe3ce1ef03097f5165d0d8e71300f4679bf827d353cedb4e33d28
SSDEEP

768:465gTbz0WSiDBQJuNBX9STk1ObfK4Q+rWB4yOwxiB9Sb6Axb9gkZ8hYcl1:4egTjnGYBtSTkIbHQK3wLJLb8ac

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4248	788	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 788	3064	rundll32.exe	81
PID 3064 wrote to memory of 788	3064	rundll32.exe	81
PID 3064 wrote to memory of 788	3064	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MegaMan Unlimited\vorbisfile.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MegaMan Unlimited\vorbisfile.dll",#1
  2⤵
  PID:788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 452
    3⤵
    - Program crash
    PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 788 -ip 788
1⤵
PID:3644

memory/788-1-0x0000000002440000-0x000000000244E000-memory.dmp

Filesize
56KB

Download
memory/788-0-0x0000000002450000-0x0000000002570000-memory.dmp

Filesize
1.1MB

Download