40a90ddd4f4491ee74b28bdea5524fc01a484ab827954f2d2f1cb25461610573

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 17:47

Target

Super Hexagon/Super Hexagon/FreeType-6.dll
Size

356KB
MD5

e8a84fc74e359f86c7bdf61170cac17b
SHA1

1911978ec68a2fb74181215689f97664d2560172
SHA256

4cedbc6051284f8c7e18f598531b6acd5f60bb1a158e521e71d4039f566b369f
SHA512

936f87e151b4bd5db79ffaafab9442676a3cf8ef4b131515344e04c8a4366bd1fcfa0deb0b9f993a2b85fb0c941e3b821e4364d340a919baf603cdbbf98a92bc
SSDEEP

6144:DUhFEoYhnDbcrFk/PF2uV05X8g6zxs6URgVkfw3v:DoFEoYhnDbcFk/92HATmAv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4888	1184	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3464 wrote to memory of 1184	3464	rundll32.exe	82
PID 3464 wrote to memory of 1184	3464	rundll32.exe	82
PID 3464 wrote to memory of 1184	3464	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\FreeType-6.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\FreeType-6.dll",#1
  2⤵
  PID:1184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 604
    3⤵
    - Program crash
    PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1184 -ip 1184
1⤵
PID:3784

memory/1184-0-0x0000000001450000-0x0000000001477000-memory.dmp

Filesize
156KB

Download
memory/1184-1-0x000000006D380000-0x000000006D3D1000-memory.dmp

Filesize
324KB

Download