10d7316ef9c54377354243744d16882e92cb97c4310eaeebc3f583abf5f9214c

Analysis

max time kernel
1666s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 14:44

Target

EraRev_Launcher/Client/Microsoft.VC90.CRT/msvcr90.dll
Size

640KB
MD5

e7d91d008fe76423962b91c43c88e4eb
SHA1

29268ef0cd220ad3c5e9812befd3f5759b27a266
SHA256

ed0170d3de86da33e02bfa1605eec8ff6010583481b1c530843867c1939d2185
SHA512

c3d5da1631860c92decf4393d57d8bff0c7a80758c9b9678d291b449be536465bda7a4c917e77b58a82d1d7bfc1f4b3bee9216d531086659c40c41febcdcae92
SSDEEP

12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4756 wrote to memory of 1172	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 1172	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 1172	4756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\Microsoft.VC90.CRT\msvcr90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\Microsoft.VC90.CRT\msvcr90.dll,#1
2⤵
PID:1172