fa925b3e76ed9daa56d7dc81d622202a7aa2649f923f97a986d214bc1ccad048

Analysis

max time kernel
137s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 22:39

Target
Cat.Goes.Fishing.v13.11.2019/steam_api.dll
Size 219KB
Sample240302-2lcnbsae44
SHA256 af17df745250d1814eaa274fff7b0faeb43381e6762e026267e5859778477abd
MD5 fe8e00c889a156836d57919ca23cde50
SHA1 7aba06d474175bd0d7f672e101b0a05104580bb1
SHA512 bdd89b54381da6faf50c9e18d9941f68b8d300d952bea84bd785ca00d617eef6dbdf7d9589adfb14e1dcbe6d836bb2d7785ccc9529e781a64f3125bfc4ce091c
SSDEEP 3072:Mc8htAhfVOxDSMVmNp3yv5GPNSv7WAbYiAs+6pyiy6oICJwRWbaqH2RD4f:MptAhNOhVmN+wPNSljyCCJcWaef
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
316	3488	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3488	4168	rundll32.exe	94
PID 4168 wrote to memory of 3488	4168	rundll32.exe	94
PID 4168 wrote to memory of 3488	4168	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\steam_api.dll,#1
  2⤵
  PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 612
    3⤵
    - Program crash
    PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3488 -ip 3488
1⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3724 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:1368