b87421b0a78776bfb05ed9cf52d19b8e00fc266e25d08438168cd7c636c7b827

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:21

Target

mods/UpscalerBasePlugin/ffx_fsr2_api_dx12_x64.dll
Size

2.8MB
MD5

f4b84ac0f819dc24cb900925d4aa0480
SHA1

2ce3972ec9f8e3cfda610e48bf62ddea528fd12a
SHA256

0cc5d5b1e13b020a900056500080c52e43f7de6e06e98660b98f1981d5794372
SHA512

a2b01d2567b605e86e78e3d8fa0eae993b211ece093d2a7bb1f677a2dd63dc60f311c9e802d627425e94e6a1632172ffafe877429dc181874b24afcc20f01b1e
SSDEEP

24576:zQm6VHBOoIKGbacWymkzSypuvscyDBjbHbAUsOLnWLaWUdyHm:yBOM20x3gXsI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1172	1812	rundll32.exe	28
PID 1812 wrote to memory of 1172	1812	rundll32.exe	28
PID 1812 wrote to memory of 1172	1812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mods\UpscalerBasePlugin\ffx_fsr2_api_dx12_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1812 -s 80
  2⤵
  PID:1172