40a90ddd4f4491ee74b28bdea5524fc01a484ab827954f2d2f1cb25461610573

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 17:47

Target

Super Hexagon/Super Hexagon/Zlib.dll
Size

68KB
MD5

48affbcb623a3e56c83e5d28f0583ce6
SHA1

7e202febc01554f3320541a2941c12b9e855eccb
SHA256

edd08eb064ed586630960568aa995cf046ecd9557f97adfd793b2a135048eb77
SHA512

c9306cdc1a71a86a89778fa82bf5260534a419bfad9984688d07d491fa20b68c53a103aea862f3cbf4fc3870d37a6405ca757d9bbcc93e2868c57645ff1993d4
SSDEEP

768:nRagNMR87pA2cp+k8AVfgibjlR1L+zwWMyKO+zlSXuNiOxPj6:nRkREpITVfgin1iz91C8hA

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3416	572	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3764 wrote to memory of 572	3764	rundll32.exe	81
PID 3764 wrote to memory of 572	3764	rundll32.exe	81
PID 3764 wrote to memory of 572	3764	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\Zlib.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\Zlib.dll",#1
  2⤵
  PID:572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 604
    3⤵
    - Program crash
    PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 572 -ip 572
1⤵
PID:4952

memory/572-0-0x0000000000CC0000-0x0000000000CE7000-memory.dmp

Filesize
156KB

Download