731ff864aef3e98931b5550125b2ba975ab9df334fbb9f0c026d0ca22c2e1457

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 03:20

Target

app/dll64/Live2DCubismCoreJNI.dll
Size

110KB
MD5

8f90d89d3a7e51255b0262cb7c5b69a8
SHA1

c181fc4154bd66a5fd669b24432503b18fffe55b
SHA256

a1c9c194c0518756b47538c4164311c235a83ac77ec51b992a7e01e8125c7bca
SHA512

5999960adfc4933421e3947809e83dea3b244dd689dc406f6b44fd24b22efd2efce7ae1886568729e52814893af3a7cfc09a1a15a6e9f4031d7545f7d7788efe
SSDEEP

3072:JSA70QQ+eRBO13JqWSLYpFkbBjA4dWZamqELZehP0nO:JSAAQQ9nO12LYpFkWlZamqKZRO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2984	2676	rundll32.exe	30
PID 2676 wrote to memory of 2984	2676	rundll32.exe	30
PID 2676 wrote to memory of 2984	2676	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\app\dll64\Live2DCubismCoreJNI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2676 -s 80
  2⤵
  PID:2984