b1d86b3972a7837857ba7b023b062be8a0baa00398c92bebb8917df2566c82c1

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 16:03

Target

MMORPGUPDTDNDIS Pass MMODEVBELIANO/Belianogames/bin/Release/system/Fire.dll
Size

308KB
MD5

385a0193e336a2f2f8d549bd3c5310a4
SHA1

76bcee3e3cde7a8a02549cd32d30ba5ff0050f40
SHA256

fbdab449469d1b469b87db48c6e321c419d24263a401bfd9d0b02172cdfe6c5b
SHA512

35aa2dbed80020c22810299d1ce5205400c422d13505f63e2d4a4922fb766697f5b1eddf212049cf0241edff8a7ab2f4c5c5d7754ddb79e081fda1ad62f898fa
SSDEEP

3072:+AshkEC+niW81TLmvz5u/p3T9R4VLioH7D5kVOqBGPYz:0yKvz5uh3TwDSVOJPYz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	1656	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1656	2496	rundll32.exe	28
PID 2496 wrote to memory of 1656	2496	rundll32.exe	28
PID 2496 wrote to memory of 1656	2496	rundll32.exe	28
PID 2496 wrote to memory of 1656	2496	rundll32.exe	28
PID 2496 wrote to memory of 1656	2496	rundll32.exe	28
PID 2496 wrote to memory of 1656	2496	rundll32.exe	28
PID 2496 wrote to memory of 1656	2496	rundll32.exe	28
PID 1656 wrote to memory of 2072	1656	rundll32.exe	29
PID 1656 wrote to memory of 2072	1656	rundll32.exe	29
PID 1656 wrote to memory of 2072	1656	rundll32.exe	29
PID 1656 wrote to memory of 2072	1656	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MMORPGUPDTDNDIS Pass MMODEVBELIANO\Belianogames\bin\Release\system\Fire.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MMORPGUPDTDNDIS Pass MMODEVBELIANO\Belianogames\bin\Release\system\Fire.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 232
    3⤵
    - Program crash
    PID:2072

memory/1656-0-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/1656-2-0x00000000002C0000-0x00000000002FF000-memory.dmp

Filesize
252KB

Download
memory/1656-3-0x00000000009B0000-0x00000000009EB000-memory.dmp

Filesize
236KB

Download
memory/1656-5-0x00000000020B0000-0x0000000003E21000-memory.dmp

Filesize
29.4MB

Download
memory/1656-6-0x00000000020B0000-0x0000000003E21000-memory.dmp

Filesize
29.4MB

Download