33d0e5e173f8b94023257786775091c96b949eb106e41f728d7077e54bc7aed9

Analysis

max time kernel
119s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 17:58

Target

Pizza Tower/fmod-gamemaker.dll
Size

35KB
MD5

7d03df224eef39d3c507e33fe2165158
SHA1

c8a1f626079a3a7e750d5205d1ed92f3f9d6c499
SHA256

0cbb76f9bd8987c194b891c3c0b14c3ffb15ae0f676623a811090ca7619bd3b3
SHA512

2dd05d7495456cda7bbea293032569ea6956b22f9e96e2a68de291bb3cc54e5240471d3994a04ff3481f4d76ded694803e55a870490a8aa8ba806a82d596ab54
SSDEEP

384:HshbIB/FimHZgyn1bMVB39LkS7XuTE8L8RMO3VH6cbJ/NlGz8WDf9qGuokHmbPIz:4+S1/NlGz8W7bIOPOP4I7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2144	2872	rundll32.exe	30
PID 2872 wrote to memory of 2144	2872	rundll32.exe	30
PID 2872 wrote to memory of 2144	2872	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Pizza Tower\fmod-gamemaker.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 140
  2⤵
  PID:2144