b1d86b3972a7837857ba7b023b062be8a0baa00398c92bebb8917df2566c82c1

Analysis

max time kernel
134s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 16:03

Target

MMORPGUPDTDNDIS Pass MMODEVBELIANO/Belianogames/bin/Release/system/D3DDrv.dll
Size

1.2MB
MD5

8ab869364379486f220259fa1c6c7d90
SHA1

9f05d1fff78e8edf397797a9a6bc7c22c4572e3a
SHA256

2b496d235cca529b6180588a987ca0059600a2323193d96e87b90014105be0c2
SHA512

3c9eec9ad1d8517881a03d5cb4368e6a2abc0d13f62ca1d6506457790c7718ade0def55e05937ec7b35ea4fef288b708648512d14d0f00b8d2abc365e865331b
SSDEEP

12288:INzIsboKAswrxh8wMYp2tVSvVVkw/iUYVOK8B7plnZu0VHMqGX0Ou18z/AntRoaF:seHkw/lD5nE0VsqJmz/Afoafd2hnbY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4600	4636	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4636	4624	rundll32.exe	85
PID 4624 wrote to memory of 4636	4624	rundll32.exe	85
PID 4624 wrote to memory of 4636	4624	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MMORPGUPDTDNDIS Pass MMODEVBELIANO\Belianogames\bin\Release\system\D3DDrv.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MMORPGUPDTDNDIS Pass MMODEVBELIANO\Belianogames\bin\Release\system\D3DDrv.dll",#1
  2⤵
  PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 748
    3⤵
    - Program crash
    PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4636 -ip 4636
1⤵
PID:4284

memory/4636-2-0x0000000002EC0000-0x0000000002EFB000-memory.dmp

Filesize
236KB

Download
memory/4636-5-0x0000000002F50000-0x0000000002F8F000-memory.dmp

Filesize
252KB

Download
memory/4636-4-0x0000000002F30000-0x0000000002F3F000-memory.dmp

Filesize
60KB

Download
memory/4636-3-0x0000000002F00000-0x0000000002F1C000-memory.dmp

Filesize
112KB

Download
memory/4636-0-0x0000000002C60000-0x0000000002EB2000-memory.dmp

Filesize
2.3MB

Download
memory/4636-7-0x0000000010300000-0x0000000012071000-memory.dmp

Filesize
29.4MB

Download