c291f69fe2c0a95a9949ac15d06182344d646cf591752e0db27e2a09c90a97e6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 10:12

Target

GFSDK_Aftermath_Lib.x86.dll
Size

25KB
MD5

ec9e77c1667b06494a9379db4b9f9b5b
SHA1

faae0fbce1b657f63eea4fd5f13be8c1304d00f8
SHA256

ff30a4ca1b005f05a443ae5d48eb714ea5a917b6b4a5ef361efce8ba1d3c8420
SHA512

09c3ded060573a601c5f237da616b5f70a0d088bce3c56aef071f6ec1f8fd5f2135d933de2b1f7cf97f8aa261c6ff32a1f624f890c652428d72335037e53f484
SSDEEP

384:yKMGNMu5Rh2MZvc/77nZZjoQ144Q3AW8umkYIkOI39R3rEGdh1:pMGNMIL2MQ3ZZEQa+WMkYIkRDbL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	2096	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2096 wrote to memory of 1228	2096	rundll32.exe	29
PID 2096 wrote to memory of 1228	2096	rundll32.exe	29
PID 2096 wrote to memory of 1228	2096	rundll32.exe	29
PID 2096 wrote to memory of 1228	2096	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GFSDK_Aftermath_Lib.x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GFSDK_Aftermath_Lib.x86.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 220
    3⤵
    - Program crash
    PID:1228