10d7316ef9c54377354243744d16882e92cb97c4310eaeebc3f583abf5f9214c

Analysis

max time kernel
1380s
max time network
1176s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 14:44

Target

EraRev_Launcher/Client/rgpar.dll
Size

101KB
MD5

7acb30afe94c12c270f76965d73bef76
SHA1

c8e497196e24e8d1a8c9965b17bf282c36a0a7b6
SHA256

97ffa2b58ccf5a9fab91e2d536521348ce0a529c8fc024e5e1de892a6a43d801
SHA512

47e63d223987a7acbe2bff6d26e4ae887994fafd4b0648419c3c73ce58ccd077367a678d2bcfefdf42bf533d06d4c442006ac159a7510ba9930968c9e271adb1
SSDEEP

3072:pqAtzrujQ2aMiN2iq5kpwESFWNAPwDhxTxAw0WOtgEXLNP4q:kiHb71pxAw0WOtgE7NPz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5052 1172 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5052	1172	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2708 wrote to memory of 1172	2708	rundll32.exe	rundll32.exe
PID 2708 wrote to memory of 1172	2708	rundll32.exe	rundll32.exe
PID 2708 wrote to memory of 1172	2708	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rgpar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\rgpar.dll,#1
2⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 612
3⤵
- Program crash
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1172 -ip 1172
1⤵
PID:2512

memory/1172-0-0x00000000020B0000-0x0000000002573000-memory.dmp

Filesize
4.8MB

Download