75907add2f5bc078ed61b4fbb48ab7009e9c5e19f4967fb2775ce5cde26d96a3

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 14:04

Target

Terraria/TerrariaServer.exe
Size

19.0MB
MD5

4327cde8ba30f722a6adc6e13cdc0932
SHA1

276843e88964e9923cc155ee9b4dea120a4524e0
SHA256

fdab0de75c233caebde2ea777abf66abac9cc2a30056a8e402ff25dbd6fb652c
SHA512

3544ca86a80c984ccb4cbbad860085c9661c7a9921af11b7af617f6172ee6d3f9a46664452ef5492ee454ed705727991f9f8bc414bafc7c338a334616c1fe076
SSDEEP

98304:TNpUDqATyuoxefZUcFuutryPiusaIWdImnGOhxb0iDk3qMaEubRP3uZt55ud:T0DD+Ca5PxMMbRP3uZtSd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2908	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2748	2908	TerrariaServer.exe	29
PID 2908 wrote to memory of 2748	2908	TerrariaServer.exe	29
PID 2908 wrote to memory of 2748	2908	TerrariaServer.exe	29
PID 2908 wrote to memory of 2748	2908	TerrariaServer.exe	29

C:\Users\Admin\AppData\Local\Temp\Terraria\TerrariaServer.exe
"C:\Users\Admin\AppData\Local\Temp\Terraria\TerrariaServer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 612
  2⤵
  - Program crash
  PID:2748

memory/2908-0-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-1-0x0000000001230000-0x0000000002540000-memory.dmp

Filesize
19.1MB

Download
memory/2908-2-0x0000000000920000-0x000000000094E000-memory.dmp

Filesize
184KB

Download
memory/2908-3-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download