a1deea5812fdb37484daaa06accdd2040f8a3af12a66498dd7c02eb69335b49a

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 04:16

Target

mods/UpscalerBasePlugin/ffx_fsr3_x64.dll
Size

21KB
MD5

8bdbad4b738112988b25ad0e978727e4
SHA1

0c4578005a773cbfdfaca4402b1c9502bd06a709
SHA256

e6fcb56a91cf135d0c203ac52fad09fd65c1c9faa75e77d97f14223581dcd4bb
SHA512

8a120ab407bd759a02bce11e9e808daf46a9fb29e848033fd26fd510eb7c4b0d2880e4aeee6b88fcbcdb25dd39eda16e496d77508a2811fdfb838d51f5af10cc
SSDEEP

384:pslAGqH3Qyrs43TXLg7QXkZYs7uTR8SNWkx5AjDLovA9UY/7hJbDFiv5E:W8Qy33TXLiQXi74rNWkx4DWA9UY/7zJ1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mods\UpscalerBasePlugin\ffx_fsr3_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1648 -s 80
  2⤵
  PID:2084