406a23ff989e9ea29398993c0842f5a0202c3cffa54ef2fa21798767624d4719

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 14:15

Target

Fraps/data/Lib/Lib2.dll
Size

208KB
MD5

9eefb97a2fd4bc1d3c43db1c86033b00
SHA1

ca03c90a99fca4360213869f1d1d06075bcba44a
SHA256

9e17951c529144886b1b7c36df7885033258528c795ab2b606e95d364c519f3d
SHA512

900977b8be48dbd2ec233a4b9a9e73598a2744c4e6bf95c7e64a61c0888390cf8b74310c025f3398d2666c867d44c353df50a81d0b403e8bd948cf547303fa4e
SSDEEP

3072:BVoWeMW1/5U/yaRisXt48Lj7oW8SA1AKl0Ckq0Dq88mIilWpoZ+3bbjko:z9IxWyapX3LjMWYCKl0CTeKmMM+J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4064	3460	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3460	640	rundll32.exe	88
PID 640 wrote to memory of 3460	640	rundll32.exe	88
PID 640 wrote to memory of 3460	640	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
  2⤵
  PID:3460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 600
    3⤵
    - Program crash
    PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3460 -ip 3460
1⤵
PID:2124