File scan report
Verdict Malicious
Is FATAL CHOICE.
A completed sandbox issued a malicious finding after unusual rundll32 activity and mapped defense impairment, despite no detections among 75 antivirus engines.
Read the whole reasonShow less
Moderate evidence · Few antivirus engines flag it; other checks support the rating.
If you already opened or extracted it, follow the steps below.
What to do now3 steps
This RAR archive is harmful. Don't open or extract it, and delete it.
If you haven't opened or extracted it
Don't open or extract this archive. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash.
If you already opened or extracted it
If you already extracted it, delete the extracted files too and run a full antivirus scan.
If a page it opened asked for a password or card details and you entered them, change that password and call your bank.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
0 of 59 flagged
- Flagged 0
- No detection 59
- No result 16
- Code signing Not applicable
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The only completed sandbox run produced a malicious finding and mapped possible process injection and defense impairment. Although none of the 59 antivirus engines that checked it flagged the archive and no malware family was identified, the unusual rundll32 execution against multiple Unity DLLs makes running the extracted program an unacceptable risk.
None of the 59 antivirus engines that checked it flagged the archive, so the static antivirus evidence is strongly reassuring. However, the one completed sandbox run issued a malicious finding, with no clean sandbox run contradicting it. Runtime mappings included and T1562.001, and rundll32 was used to invoke several Unity DLLs through an export-style command. No complete contacted-host reputation result is available, though the recorded run listed no sample network contacts.
What We Detected
None of the 59 antivirus engines that checked it flagged the RAR archive, including 18 major antivirus engines that reported no detection. In contrast, the sole completed sandbox run returned a malicious finding. It also recorded repeated rundll32 commands targeting Unity-related DLLs with an export-style #1 argument.
Threat Behavior
The evidence from the test run mapped T1055 for possible process injection and T1562.001 for possible impairment of defenses. The saved evidence does not identify an injected target process, so the exact T1055 mechanism remains unproven. The archive also extracted what appears to be a Unity application and wrote ordinary Unity player settings, creating a plausible benign explanation for some surrounding activity, but not enough to dismiss the sandbox finding. No complete contacted-host reputation cross-check is available, and the ten extracted children lack saved verdicts.
What To Do Now
Do not open or execute the extracted program on a production system. Keep security software enabled, quarantine the archive, and obtain a fresh copy only from a verified developer channel; if investigation is necessary, use an isolated disposable environment and separately scan every extracted executable and DLL.
Where this verdict could be wrong4 caveats
- None of the 59 antivirus engines that checked it flagged the archive, including 18 major antivirus engines reporting no detection.
- No malware-specific YARA rule or MalwareBazaar family match corroborates the runtime finding.
- The mapping does not name an injected process, and the saved process-injection target list is empty.
- The archive appears to contain a Unity application, so some environmental checks, registry settings, and temporary extraction activity may have benign explanations.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 59 antivirus engines that checked it flagged the archive.
- All 18 major antivirus engines that reported results returned no detection.
- No malware-specific research rule or known malware-repository match was found.
- No extracted child has a saved malicious classification.
- The sample was submitted by 31 distinct sources rather than being from a single source.
- The sole completed sandbox run produced a malicious finding.
- The test run mapped possible process injection and possible impairment of defenses.
- The extracted application used rundll32 to invoke several Unity DLLs through an unusual export-style command.
- No complete reputation check is available for runtime hosts.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 13sandbox rule tags
- 14spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Checked whether it was running on a test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Checked which security software was installed on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
FATAL CHOICE.rar
7ef850c82c2045bed221c645d09314edbbf7c3d7af82596232378a66257af8af
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Unity.Postprocessing.Runtime.dll",#1
Test run - Evidence 3 of 5: ProcessSeen in the test run
rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Unity.TextMeshPro.dll",#1
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
Player.log
C:\Users\<USER>\AppData\LocalLow\kyezdev Studios\FATAL CHOICE\Player.log
Test run - Evidence 5 of 5: Written fileSeen in the test run
CASESENSITIVETEST67d19907955a4b2e9a70196180f2a977
C:\Users\<USER>\AppData\Local\Temp\CASESENSITIVETEST67d19907955a4b2e9a70196180f2a977
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
The combined sandbox summary includes a "malicious" verdict.
Sandbox verdicts
1- VT: MALWAREmalicious
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1036
- T1055· Process injection
- T1056· Keylogging
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1106
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1574.002· Execution hijack
Observed activity
Processes started
14Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Unity.Postprocessing.Runtime.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Unity.TextMeshPro.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Unity.Timeline.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Unity.VisualScripting.Antlr3.Runtime.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Unity.VisualScripting.Core.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Unity.VisualScripting.Flow.dll",#1
Show all 14 entries for processes started
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Unity.VisualScripting.State.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/UnityEngine.AccessibilityModule.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/UnityEngine.AIModule.dll",#1FATAL CHOICE.exe"C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE.exe"UnityCrashHandler64.exe"C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE\UnityCrashHandler64.exe" --attach 3524 2085705224192rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Assembly-CSharp.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Cinemachine.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FATAL CHOICE/FATAL CHOICE_Data/Managed/Mono.Security.dll",#1
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\LocalLow\kyezdev Studios\FATAL CHOICE\Player.log - Written
C:\Users\<USER>\AppData\Local\Temp\CASESENSITIVETEST67d19907955a4b2e9a70196180f2a977 - Written
C:\Users\user\AppData\LocalLow\kyezdev Studios - Written
C:\Users\user\AppData\LocalLow\kyezdev Studios\FATAL CHOICE - Written
C:\Users\user\AppData\LocalLow\kyezdev Studios\FATAL CHOICE\Player.log - Written
C:\Users\user\AppData\Local\Temp\CASESENSITIVETESTf88822b48a9347608ee5cd33e3fe781b
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\shgihcvo.mvb - Written
C:\Users\user\AppData\Local\Temp\shgihcvo.mvb\FATAL CHOICE - Written
C:\Users\user\AppData\Local\Temp\shgihcvo.mvb\FATAL CHOICE\FATAL CHOICE.exe - Written
C:\Users\user\AppData\Local\Temp\shgihcvo.mvb\FATAL CHOICE\FATAL CHOICE_Data - Written
C:\Users\user\AppData\Local\Temp\shgihcvo.mvb\FATAL CHOICE\FATAL CHOICE_Data\Managed - Written
C:\Users\user\AppData\Local\Temp\shgihcvo.mvb\FATAL CHOICE\FATAL CHOICE_Data\Managed\Assembly-CSharp.dll - Written
C:\Users\user\AppData\Local\Temp\shgihcvo.mvb\FATAL CHOICE\FATAL CHOICE_Data\Managed\Cinemachine.dll - Written
C:\Users\user\AppData\Local\Temp\shgihcvo.mvb\FATAL CHOICE\FATAL CHOICE_Data\Managed\Mono.Security.dll - Written
C:\Users\user\AppData\Local\Temp\shgihcvo.mvb\FATAL CHOICE\FATAL CHOICE_Data\Managed\System.ComponentModel.Composition.dll
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Stereo 3D_h1665754519 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Resolution Width Default_h680557497 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Resolution Height Default_h1380706816 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Resolution Use Native Default_h1405981789 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Fullscreen mode Default_h401710285 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\UnitySelectMonitor_h17969598
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Window Position X_h4088080503 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Window Position Y_h4088080502 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Resolution Width_h182942802 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Resolution Height_h2627697771 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Resolution Use Native_h1405027254 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\Screenmanager Fullscreen mode_h3630240806 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\unity.player_session_count_h922449978 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios\FATAL CHOICE\unity.player_sessionid_h1351336811 - Set
HKEY_CURRENT_USER\SOFTWARE\kyezdev Studios
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- a5715a6a0d5edfa26683…bb59d5Not checkedno saved verdict
- 6b203e7078654ee3dc15…784b98Not checkedno saved verdict
- 2ed2548e46c313fdb8bb…6ae186Not checkedno saved verdict
- 44c9e9cac39001c65a05…62bc95Not checkedno saved verdict
- a5b68b53496aa0c64732…e7d409Not checkedno saved verdict
- 0c56e34c69124510fa8c…9e396dNot checkedno saved verdict
- 81bd9c25487810577418…38c12dNot checkedno saved verdict
- e7b07c5df817b2be20f5…1944efNot checkedno saved verdict
- 7e882c61c4048ff7339b…69cdd4Not checkedno saved verdict
- 3f8d565f1eaa9528d341…c46b65Not checkedno saved verdict
Chapter 04
Technical details
None of the 59 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 14, 2026, 6:31 PM UTC
- SHA-256
7ef850c82c2045bed221c645d09314edbbf7c3d7af82596232378a66257af8af- SHA-1
4f52ebdbdcbc8ccaad6408870f6dd4791242d2c7- MD5
48e1ce12185c4ecf42c0e8883cf5c776
About this file
FATAL CHOICE.rar is an RAR file of 29.8 MB.
- Type and size
- RAR · 29.8 MB
- Signer
- Not applicable
- First seen
- Jan 25, 2025On VirusTotal.
- Submitted by
- 31 distinct sources
First scanned
Antivirus consensus
0 of 59 engines flagged this file
16 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-230 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavNo result
- CAT-QuickHealNo result
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeClean
- McAfeeDNo result
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is FATAL CHOICE.rar malware?
What is FATAL CHOICE.rar?
How many antivirus engines detected FATAL CHOICE.rar?
I already downloaded and opened or extracted FATAL CHOICE.rar — what should I do?
How do I remove FATAL CHOICE.rar?
What kind of malware is FATAL CHOICE.rar?
What is the SHA-256 hash of FATAL CHOICE.rar?
How up to date is this analysis of FATAL CHOICE.rar?
Community
Member reviews and reports for this exact file hash.