6c48e88b559900b1627bd163f9fbe2870acf0506cc2c333e088fddf2cb653c90

Analysis

max time kernel
1s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 02:01

Target

yuzu-windows-msvc/Qt5QmlModels.dll
Size

428KB
MD5

2030c4177b499e6118be5b9e5761fce1
SHA1

050d0e67c4aa890c80f46cf615431004f2f4f8fc
SHA256

51e4e5a5e91f78774c44f69b599fae4735277ef2918f7061778615cb5c4f6e81
SHA512

488f7d5d9d8deee9bbb9d63dae346e46efeb62456279f388b323777999b597c2d5aea0ee379bdf94c9cbcfd3367d344fb6b5e90ac40be2ce95efa5bbdd363bcc
SSDEEP

6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2192	2156	rundll32.exe	31
PID 2156 wrote to memory of 2192	2156	rundll32.exe	31
PID 2156 wrote to memory of 2192	2156	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\yuzu-windows-msvc\Qt5QmlModels.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2156 -s 224
  2⤵
  PID:2192