229cbbac4a8000069d5ea52b0a864345b2e0a624f152f7f0472b942d2f269e29

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 20:26

Target

PvZ_Tools_v2.7.5/Qt5Core.dll
Size

4.3MB
MD5

f42a2786725e8caee162b048ecd4d6c0
SHA1

6bf6fd4aad32116a2f17499d121fbf592bacb5c8
SHA256

1e6cebc0e88690f25991554de04a75b91a0fda47a732930762c42309ca019049
SHA512

358c07c4ee4a5e012f9f7d514589ea3cfdd196a0bc3304c7380e3daa340f28bacdeec871e0b6332d36bf98b397f4d8ff4a9084d43da94e72f39afd0fcc196e37
SSDEEP

98304:dAhJjX07CI6XmIld1wRJRJsv6tWKFdu9CfvIWgw:yhJ1IBEdsJsv6tWKFdu9CfvF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	2060	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2132 wrote to memory of 2060	2132	rundll32.exe	28
PID 2060 wrote to memory of 2240	2060	rundll32.exe	29
PID 2060 wrote to memory of 2240	2060	rundll32.exe	29
PID 2060 wrote to memory of 2240	2060	rundll32.exe	29
PID 2060 wrote to memory of 2240	2060	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\Qt5Core.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 252
    3⤵
    - Program crash
    PID:2240