10d7316ef9c54377354243744d16882e92cb97c4310eaeebc3f583abf5f9214c

Analysis

max time kernel
1389s
max time network
1187s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 14:44

Target

EraRev_Launcher/Client/rgmain.dll
Size

4.7MB
MD5

3ea0c7cc88ef1329b4cb60fb9f3861c4
SHA1

da527ec282fef9e0fc5a74666801b4b57d9a58cf
SHA256

b67d2e96c5bf28fe48799a96c7927c57b91c74e483b30975ee58ca45f470153c
SHA512

0fc75a6a299d0542254a1206cde8a5e7964470f5700921a76b3a8cc67ea0f4ffe51b3d40ab5fe3f35e42c181a256d21e7d8d10629589546c118605b9439f8e38
SSDEEP

49152:Kh0n8/Iupbb89ZMvEyArxbslBIdflK/QeGRx73T7nKZGpyQTD5T/D8CyYghsDN:Nn0XbbolslBcflKxenQGVyY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

884 3504 WerFault.exe rundll32.exe

pid	pid_target	process	target process
884	3504	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4036 wrote to memory of 3504	4036	rundll32.exe	rundll32.exe
PID 4036 wrote to memory of 3504	4036	rundll32.exe	rundll32.exe
PID 4036 wrote to memory of 3504	4036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rgmain.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rgmain.dll,#1
2⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 604
3⤵
- Program crash
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3504 -ip 3504
1⤵
PID:1004