1bc59ac58f62ba1bec6d0fdd11a7e89c146d233536a198154dae0ec47013356d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 20:51

Target

Rift-2.0/Rift.Backend.exe
Size

651KB
MD5

19cfde028fc4bfe518c8f04a44b4236e
SHA1

e001d52b061357c243c5ba0eb05f7363f616ed27
SHA256

c9f6e806354fe226d44249ceeaf13c202576dfb6600825caa405aa7b074988a5
SHA512

8c9a4b8b1bf8aae32ca12e87260d13617560ad748d6112e47ba599744dacff3cb2a7c3f15972bc3a6c1e3da4c419116715f103bf5929db37cd39d7b334976942
SSDEEP

12288:ZxJqCcxEHbp/0e2SOHKyxuBXOE/acv9rd6iSztJbC+htuxF:Zbck/0ewHXUNOE/acv9giSztJs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Rift.Backend.exe

description	pid	process	target process
PID 1500 wrote to memory of 2116	1500	Rift.Backend.exe	WerFault.exe
PID 1500 wrote to memory of 2116	1500	Rift.Backend.exe	WerFault.exe
PID 1500 wrote to memory of 2116	1500	Rift.Backend.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Rift-2.0\Rift.Backend.exe
"C:\Users\Admin\AppData\Local\Temp\Rift-2.0\Rift.Backend.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1500 -s 520
2⤵
PID:2116

memory/1500-0-0x000007FEF5633000-0x000007FEF5634000-memory.dmp

Filesize
4KB

Download
memory/1500-1-0x0000000000AE0000-0x0000000000B8A000-memory.dmp

Filesize
680KB

Download
memory/1500-2-0x000007FEF5633000-0x000007FEF5634000-memory.dmp

Filesize
4KB

Download