731ff864aef3e98931b5550125b2ba975ab9df334fbb9f0c026d0ca22c2e1457

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 03:20

Target

app/dll64/Live2DCubismPFUtilsJNI.dll
Size

21KB
MD5

47f4ae3c4ded692e3d5c6cc657015044
SHA1

f81c29ebaa1a5973062c31e510c333ede2e960c3
SHA256

4808d08b6a23e51f18a2aaca449f8b8bb9355a71cdbdbd80c54efbdfe87bbc7f
SHA512

40165631aaabfa2ce43f2ba47d188b25c401703d87468b255b5af3fa08c6f90ad1a3a31e88293ab8c1309346706c2c2ac8363ada25086813fc614e2cf6368ec8
SSDEEP

384:UQGTnn3wweMoU/u2WuFRGfFbHcXKcvhzOIWQGV1VF0hXHMGBk7/UMQ3+Bj:UBnt9o12ToFbHcXwIWHV1VaXLkjdj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2128	2564	rundll32.exe	31
PID 2564 wrote to memory of 2128	2564	rundll32.exe	31
PID 2564 wrote to memory of 2128	2564	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\app\dll64\Live2DCubismPFUtilsJNI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2564 -s 80
  2⤵
  PID:2128