10d7316ef9c54377354243744d16882e92cb97c4310eaeebc3f583abf5f9214c

Analysis

max time kernel
1383s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 14:44

Target

EraRev_Launcher/Client/rggl.dll
Size

522KB
MD5

35dabbbbc3cc4963ee1fc4040dea40af
SHA1

25c2ae73759864795014cbeb1310efcd3e9b4893
SHA256

6178fbc6fd0ee00738901cf5803b9399ad4f60987a3e031e10651626836b8480
SHA512

364b8b00b27d5e9d4c57acabe6cac6b8a4d2e5274523cae0418cf3c65f35c43598892d496da5db63e8aee0789e7e12ce553208d0ab335fa3bf11caaa5a724e93
SSDEEP

12288:Bt6mcEKyEPiRXGGpCQYmcwMLRqqKnriO/ZWL+GOvFLuk7P:YPxvgMFonruL+GOvFLuk7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2660 2608 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2660	2608	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3732 wrote to memory of 2608	3732	rundll32.exe	rundll32.exe
PID 3732 wrote to memory of 2608	3732	rundll32.exe	rundll32.exe
PID 3732 wrote to memory of 2608	3732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rggl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rggl.dll,#1
2⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 628
3⤵
- Program crash
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2608 -ip 2608
1⤵
PID:3024

memory/2608-0-0x0000000002810000-0x0000000002CD3000-memory.dmp

Filesize
4.8MB

Download