10d7316ef9c54377354243744d16882e92cb97c4310eaeebc3f583abf5f9214c

Analysis

max time kernel
1381s
max time network
1180s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 14:44

Target

EraRev_Launcher/Client/rgdx.dll
Size

1.1MB
MD5

d362a9dcecb4c45df2f3ba47a3ea0e0d
SHA1

be689bd574cca02c0bb8dd3cc3814bc1a5c724b1
SHA256

dfce3291ea1214f37aae8e009af1891c45ab7843eb639a914d9791418559a50e
SHA512

4454b7b38ed937308a683b5866fe467064169c51640b2dcb99c68bc530963df12cd1e06da279618b8c5f3214dacc394bf90fb66e07a05e2fa598c3dd8fc1cb5e
SSDEEP

12288:yYxz617NMg0oHQqDVVaHDTNR4fKHHD+IhfGHKBlXnWgD+GfGaGw5ew6IpsfZzee7:bh6MgtLgWKiIh+AWs+3aGwsYifZzeC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4600 4744 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4600	4744	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5084 wrote to memory of 4744	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 4744	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 4744	5084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rgdx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rgdx.dll,#1
2⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 708
3⤵
- Program crash
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4744 -ip 4744
1⤵
PID:664

memory/4744-0-0x00000000022E0000-0x00000000027A3000-memory.dmp

Filesize
4.8MB

Download