94b5a5cc5729f6531032abf15914f57f7f6f6f7cb31fa816373e412ec4ade1fd

Analysis

max time kernel
1792s
max time network
1587s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04-07-2024 19:21

Target

UltimMC/libLauncher_iconfix.dll
Size

127KB
MD5

334a4297adc8c732fd71ff5832ea670b
SHA1

f8a7c3e4ab0eeaa04d1aa187270466e6c149cd9f
SHA256

0a817bbb506a5996fb0c57c36e5b43009289769b8f6facdf58fc1f475be17aef
SHA512

4cf5fa9e16c1485f3f164038c9acf140fc85dcac3ebe16337c8d2d9292fd15d942ec07bc97e8f55a64766787aa76ce5f3b2dfa460ef76d4a44e2344b32d75cc6
SSDEEP

3072:7UhA8S8fo6OjGyy1dWmC00TEUmIKOpS8aNx5tnzgp:YhA8S8fo6OjGJ1dWLTEUmIKOpS8aNx5Q

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4460 4624 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4460	4624	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4632 wrote to memory of 4624	4632	rundll32.exe	rundll32.exe
PID 4632 wrote to memory of 4624	4632	rundll32.exe	rundll32.exe
PID 4632 wrote to memory of 4624	4632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_iconfix.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_iconfix.dll,#1
2⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 684
3⤵
- Program crash
PID:4460

memory/4624-0-0x00000000045C0000-0x0000000004AEF000-memory.dmp

Filesize
5.2MB

Download
memory/4624-5-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/4624-3-0x00000000045C0000-0x0000000004AEF000-memory.dmp

Filesize
5.2MB

Download
memory/4624-6-0x00000000045C1000-0x0000000004869000-memory.dmp

Filesize
2.7MB

Download
memory/4624-7-0x00000000045C0000-0x0000000004AEF000-memory.dmp

Filesize
5.2MB

Download
memory/4624-8-0x00000000045C0000-0x0000000004AEF000-memory.dmp

Filesize
5.2MB

Download
memory/4624-9-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/4624-11-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/4624-13-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download
memory/4624-12-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/4624-10-0x0000000068AC0000-0x0000000068ACC000-memory.dmp

Filesize
48KB

Download
memory/4624-14-0x0000000061940000-0x0000000061EB5000-memory.dmp

Filesize
5.5MB

Download