b1d86b3972a7837857ba7b023b062be8a0baa00398c92bebb8917df2566c82c1

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 16:03

Target

MMORPGUPDTDNDIS Pass MMODEVBELIANO/Belianogames/bin/Release/system/ALAudio.dll
Size

344KB
MD5

9bbf6199558ae72f3cb8c54d4a09009f
SHA1

03eb84dccc2d1fed57d8d647e22ad13b2d9acfe5
SHA256

7e0c506bd1200c6eb681096a2db22dc134e78c2d64b06a4e69da0dc0e0db3881
SHA512

745a4cdadbf4602267f53b8e4f6f93317f38279983ea3fe18607960b0f84a60f57fa13a203ac34086d697b4d8365071070f412c7d492073a8f4b7112a9c92744
SSDEEP

3072:bxBEFpziJOdFWFvrhwMTsdRei8DptLivDJVpQ6BOMEvOBXw2RklAg/:5JOdFqdQsMDOTvf2Ry

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1556	2564	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 2564	4560	rundll32.exe	82
PID 4560 wrote to memory of 2564	4560	rundll32.exe	82
PID 4560 wrote to memory of 2564	4560	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MMORPGUPDTDNDIS Pass MMODEVBELIANO\Belianogames\bin\Release\system\ALAudio.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MMORPGUPDTDNDIS Pass MMODEVBELIANO\Belianogames\bin\Release\system\ALAudio.dll",#1
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 652
    3⤵
    - Program crash
    PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2564 -ip 2564
1⤵
PID:1012

memory/2564-0-0x00000000011D0000-0x00000000011EC000-memory.dmp

Filesize
112KB

Download
memory/2564-2-0x0000000004960000-0x000000000499F000-memory.dmp

Filesize
252KB

Download
memory/2564-3-0x00000000049A0000-0x00000000049DB000-memory.dmp

Filesize
236KB

Download
memory/2564-1-0x00000000012A0000-0x00000000012AF000-memory.dmp

Filesize
60KB

Download
memory/2564-6-0x0000000002BD0000-0x0000000004941000-memory.dmp

Filesize
29.4MB

Download
memory/2564-7-0x0000000002BD0000-0x0000000004941000-memory.dmp

Filesize
29.4MB

Download