5a966368146500d16fbfab05932e5f39200a6a3e805a1c8af9493a2280f27189

Analysis

max time kernel
124s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 09:49

Target

People.Playground.v1.27.3/ppgModCompiler/mscordaccore_x86_x86_5.0.1722.21314.dll
Size

967KB
MD5

e58064d079c89a4a6057ffb56f4b4575
SHA1

d33a154409d02a5bdcd79f08e46eaee38b910070
SHA256

0e28383156426886af01f0738e3988fd1d782d357f351f3942085a06a8a56922
SHA512

4652cd248aa25028ffff588470c5dea951a03e46f35a93a374048110a2dabd1a38d38f931bdd360643f333988a6e5aebf2be32394441939cc2d072e3afd5ded3
SSDEEP

24576:vZrpwuw3eX3IwYGPkiPkgCPvcOJ0fVMbqNtoH8gw42+mRfkzyeg59Ezi:vPwuw3AkmC8Nhfeyeg59Ezi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	5000	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 5000	3572	rundll32.exe	89
PID 3572 wrote to memory of 5000	3572	rundll32.exe	89
PID 3572 wrote to memory of 5000	3572	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.3\ppgModCompiler\mscordaccore_x86_x86_5.0.1722.21314.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.3\ppgModCompiler\mscordaccore_x86_x86_5.0.1722.21314.dll,#1
  2⤵
  PID:5000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 624
    3⤵
    - Program crash
    PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5000 -ip 5000
1⤵
PID:1504