d38afabdc98f8d910dba495fc8eb0868965aa0251a96db190ffba3773704f5b1

Analysis

user interaction
yes
max time kernel
899s
max time network
486s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 09:37

Target
PlantsVsZombiesRH.exe
Size 651KB
Sample261023-llwhfacf23
SHA256 d38afabdc98f8d910dba495fc8eb0868965aa0251a96db190ffba3773704f5b1
MD5 be26f3109da8ae5bc29d39e7a3405c1c
SHA1 ed7747dd1cf8d4b48af12437d857a17f2100e241
SHA512 30b897c99e4445fdfbc3eeb248468dd0ee628ded8781ce31d37d8cf667672496cf870300468f601fdcf84ef38b2fec23ddcc84856f9b0661357413ad92bb63da
SSDEEP 12288:ZH744aOD8n9G/BwO0HZaVw437Uf+OsYJaHK:59aOgGqHcVwF+KJ/
TLSH
T1BDE491D375D0F4C2DC11BD7B84E4A2EAC7369EAF9E09251B14213DA539A95380EFC839
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_player_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\dll\UnityPlayer_Win64_player_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_player_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_player_Master_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_player_Master_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_player_Master_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	PlantsVsZombiesRH.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DLL\kernel32.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\ntdll.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\WindowsPlayer_player_Master_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_player_Master_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\kernel32.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\UnityPlayer_Win64_player_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\dll\UnityPlayer_Win64_player_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_player_il2cpp_x64.pdb	PlantsVsZombiesRH.exe
File opened for modification	C:\Windows\exe\WindowsPlayer_player_Master_il2cpp_x64.pdb	PlantsVsZombiesRH.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2980	PlantsVsZombiesRH.exe
2980	PlantsVsZombiesRH.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2980	PlantsVsZombiesRH.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 720	2980	PlantsVsZombiesRH.exe	87

C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesRH.exe
"C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesRH.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 2980 2032798404608
  2⤵
  PID:720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x470
1⤵
PID:4948

memory/2980-50-0x000001DA0C8C0000-0x000001DA103F4000-memory.dmp

Download