05a27e21a0194e0b5ac0af3fe1ba6f6aa6866e874ab2fd7126421139ffb80c59

Analysis

max time kernel
150s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 16:29

Target
Plugins/FX/reacast.dll
Size 592KB
Sample240503-ty8brsba8w
SHA256 9727871867a108fb003c54c9314ed93e69db8f50b1d407c41f1287a9359e18b5
MD5 7c48cbbbe3d3dc03cf40d6b3435aa0c3
SHA1 27a95b172cdc0b6ea5749927d5b20490ddea8461
SHA512 f53e568c30eded30937aac39088d3e9f8f4e32d8141c745331e472495109a2c718d06834e24c7ff1e254f2d68b280cb305ea4d0818c6d5f153342a9ef80613ec
SSDEEP 12288:zcsgBT4d4hjm6VXz11rWvG0QSJ7+Rn3W:zctacm6tJ1CLQ+7Sn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2080	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 2080	3396	rundll32.exe	85
PID 3396 wrote to memory of 2080	3396	rundll32.exe	85
PID 3396 wrote to memory of 2080	3396	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reacast.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reacast.dll,#1
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 628
    3⤵
    - Program crash
    PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2080 -ip 2080
1⤵
PID:3920