10d7316ef9c54377354243744d16882e92cb97c4310eaeebc3f583abf5f9214c

Analysis

max time kernel
1383s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 14:44

Target

EraRev_Launcher/Client/rggl.dll
Size

522KB
MD5

35dabbbbc3cc4963ee1fc4040dea40af
SHA1

25c2ae73759864795014cbeb1310efcd3e9b4893
SHA256

6178fbc6fd0ee00738901cf5803b9399ad4f60987a3e031e10651626836b8480
SHA512

364b8b00b27d5e9d4c57acabe6cac6b8a4d2e5274523cae0418cf3c65f35c43598892d496da5db63e8aee0789e7e12ce553208d0ab335fa3bf11caaa5a724e93
SSDEEP

12288:Bt6mcEKyEPiRXGGpCQYmcwMLRqqKnriO/ZWL+GOvFLuk7P:YPxvgMFonruL+GOvFLuk7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2608	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 2608	3732	rundll32.exe	83
PID 3732 wrote to memory of 2608	3732	rundll32.exe	83
PID 3732 wrote to memory of 2608	3732	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rggl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rggl.dll,#1
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 628
    3⤵
    - Program crash
    PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2608 -ip 2608
1⤵
PID:3024

memory/2608-0-0x0000000002810000-0x0000000002CD3000-memory.dmp

Filesize
4.8MB

Download