40a90ddd4f4491ee74b28bdea5524fc01a484ab827954f2d2f1cb25461610573

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 17:47

Target

Super Hexagon/Super Hexagon/FreeImage.dll
Size

2.3MB
MD5

681a319e6639bed31cf626238d37506f
SHA1

9df7456167619328021acef45cd7b84b33ee95b9
SHA256

60710ac86a3427e7311ab2ddc77e2ece1eb03b5c9a3236fe5a26f31aa31b6d48
SHA512

0a9702bbda7b2014e4336f42ea0758e5d1db136ea3d2cf966cf1cb95940683b406e367181ec9c57fff217a2be3dd85a94f23c761dc77aea3ad0a4fc783bda12e
SSDEEP

24576:6fvJabimcsNY9L80+nhfKPUvhUkZvcVEg1WhcKp2p9AqVlQSGg70gIhTxCTMy8NO:6fvJablc8iL80HUZOUyKp29pGvgKT+p

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1592	2660	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4020 wrote to memory of 2660	4020	rundll32.exe	83
PID 4020 wrote to memory of 2660	4020	rundll32.exe	83
PID 4020 wrote to memory of 2660	4020	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\FreeImage.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\FreeImage.dll",#1
  2⤵
  PID:2660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 612
    3⤵
    - Program crash
    PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2660 -ip 2660
1⤵
PID:1424