db77f94940734815b2bbd06d1295b99b7763d5e53966a542f355b32275508a25

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 23:40

Target

Playfab Remote Player Creator.application
Size

5KB
MD5

d183381c8d3a83869863e21f318c6b49
SHA1

a0bcb95cbfdb22a49327b5914bdbb343243ed3a8
SHA256

db77f94940734815b2bbd06d1295b99b7763d5e53966a542f355b32275508a25
SHA512

1e6345b03449b3f2b22eca2229d1fb033257944bdb3a38f7a3b46d02051f85cf5bb4c91ad3e9dc3d442b3fb2d4f1a00cba58051c7b2dfea8ff38cfa5818dee59
SSDEEP

96:0WLwO9ZcR5n8pcYb24icPk0J2cNIykmO2d5aiE0kmB5ZKto2GBDA:fu9892Hx0McGyHlDIFQA

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 264	848	rundll32.exe	83
PID 848 wrote to memory of 264	848	rundll32.exe	83

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication "C:\Users\Admin\AppData\Local\Temp\Playfab Remote Player Creator.application"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:264

memory/264-0-0x00007FFD3E633000-0x00007FFD3E635000-memory.dmp

Filesize
8KB

Download
memory/264-1-0x0000023EFA820000-0x0000023EFA828000-memory.dmp

Filesize
32KB

Download
memory/264-2-0x0000023EFCEE0000-0x0000023EFD066000-memory.dmp

Filesize
1.5MB

Download
memory/264-4-0x00007FFD3E630000-0x00007FFD3F0F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-5-0x00007FFD3E630000-0x00007FFD3F0F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-7-0x00007FFD3E633000-0x00007FFD3E635000-memory.dmp

Filesize
8KB

Download
memory/264-8-0x00007FFD3E630000-0x00007FFD3F0F1000-memory.dmp

Filesize
10.8MB

Download