40a90ddd4f4491ee74b28bdea5524fc01a484ab827954f2d2f1cb25461610573

Analysis

max time kernel
94s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 17:47

Target

Super Hexagon/Super Hexagon/fmodexL.dll
Size

323KB
MD5

c5173be465e9f68f640f67479546187e
SHA1

6cbf385dfbcaf7e7aff16d3b78064cbae3138f81
SHA256

edc5f33f36e6cc84d132a6f81dca5a4e32d1341f9c2dff951b050b0c9a404162
SHA512

a12604f310d432d8153bda411f255a949b34e0a6dd4b1a5d690a1ac7a84695c9f573ee24979a55f816f650dcffe107f662a31390022ef0460538907957eea6a0
SSDEEP

6144:48a0qldUMAGDxLG5u9XnnFxj0+qCcxk7yD9XdLhrfYNNu9lxNB/tEp2Bl:4L0AzAGDZG5u1nnFG3OWvBmN

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral8/memory/3760-0-0x0000000010000000-0x000000001015D000-memory.dmp	upx
behavioral8/memory/3760-2-0x0000000010000000-0x000000001015D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	3760	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3760	3236	rundll32.exe	83
PID 3236 wrote to memory of 3760	3236	rundll32.exe	83
PID 3236 wrote to memory of 3760	3236	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\fmodexL.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Super Hexagon\Super Hexagon\fmodexL.dll",#1
  2⤵
  PID:3760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 672
    3⤵
    - Program crash
    PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3760 -ip 3760
1⤵
PID:3752

memory/3760-0-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download
memory/3760-2-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download