d1f79e21431b19c736e73266c8587148c1e39a4ecb54217e37f0cd71bc0a480a

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 21:19

Target

EA DLC Unlocker v2/origin/version.dll
Size

188KB
MD5

2ef99a682256f6b9820b876a9eb2950a
SHA1

fcd5b03210b3e0dbddd2146e66a245079dc843ac
SHA256

cf784476719a93e3fb8457a2d4c4580b691b6d04592b9a4467acf563f30d2b83
SHA512

757f1e48c3087a2bc31aa6f2573c01a21f460029090fedb03794aa63f5d49c5e6ce853bf8a57e450e211ddf83dc9eee32f8958e99e36945c5578aff5a8111e36
SSDEEP

3072:6znwT/WEMkaq3i/6+svlWTRlYOcWtAlxKm1aCk99X6tCq4OIhUujzlmZtcbdB2eo:WwT9qqMZsId+OcWOPa7dVqJujzGAwuCP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1696	2004	rundll32.exe	28
PID 2004 wrote to memory of 1696	2004	rundll32.exe	28
PID 2004 wrote to memory of 1696	2004	rundll32.exe	28
PID 2004 wrote to memory of 1696	2004	rundll32.exe	28
PID 2004 wrote to memory of 1696	2004	rundll32.exe	28
PID 2004 wrote to memory of 1696	2004	rundll32.exe	28
PID 2004 wrote to memory of 1696	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\origin\version.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\origin\version.dll",#1
  2⤵
  PID:1696

memory/1696-55-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download