09e3df6d0af19553c48a891bc78cfbf269f7ae13c9490abc975ce33f18699313

Analysis

max time kernel
452s
max time network
1179s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
04/04/2024, 20:32

Target

X2 2021 Official/GPPcScConnectionPlugin.dll
Size

12KB
MD5

d65463fc8a37261b6bf5afbc4139bdd5
SHA1

954076a2b56da1ff82eebe0c0c287110137f7cb1
SHA256

789734bbab7b606e27fab43f4706250399108dba98e4428d1b95589db0a42ea2
SHA512

cd3673e1feb07dfc86a33d499cddf7f34368bcacbbe8207826b81f9a96d9ebc74e7455170e195ae316785b42dcc871f842dfa1d0949df9f77e8738b8906339b0
SSDEEP

192:udqzHW3G3Vxv3bV/4DaRWu1Fh8+5FseTqt1emjQjA11Tml3X+EqEvaKGZ:udqzHW3G3DvbV/4Daw27vtTqtQU1xm5D

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3796	4908	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4908	4028	rundll32.exe	77
PID 4028 wrote to memory of 4908	4028	rundll32.exe	77
PID 4028 wrote to memory of 4908	4028	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X2 2021 Official\GPPcScConnectionPlugin.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X2 2021 Official\GPPcScConnectionPlugin.dll",#1
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 488
    3⤵
    - Program crash
    PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4908 -ip 4908
1⤵
PID:1908

memory/4908-0-0x0000000062E80000-0x0000000062EA2000-memory.dmp

Filesize
136KB

Download