40a90ddd4f4491ee74b28bdea5524fc01a484ab827954f2d2f1cb25461610573

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 17:47

Target

Super Hexagon/Super Hexagon/Assimp32.dll
Size

4.4MB
MD5

5cdb62a460250bbc56b53969146ca4a2
SHA1

a3e5f36e83494c9ceb82f6d86f2282afe46fddcb
SHA256

7e022a9f754d53e4690255ff4e38d3d9ce43829995c8e8e372b647164b4275ff
SHA512

5c96cf53bc00654b006b74e5315c6d51da77ba4aeadcbd66d607a1e49b307304e75e2754b14e0b3ec06ca88b132af0834600f907d162e7b10a376e540fb691ae
SSDEEP

98304:ItEZRgjs/AY7AV0KyHtFyPdMWCq0YjzBNJdE9z7QX2xmRXmEoOELyRQNYEow8omS:ItEZRgjvJ0K8yPuu0Y/BNJ29PQX2xmRe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4244	3840	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1396 wrote to memory of 3840	1396	rundll32.exe	83
PID 1396 wrote to memory of 3840	1396	rundll32.exe	83
PID 1396 wrote to memory of 3840	1396	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\Assimp32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\Assimp32.dll",#1
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 604
    3⤵
    - Program crash
    PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3840 -ip 3840
1⤵
PID:2808