2bfdefc77b83e3ac74588a82381a15de6141fd98c4d204e9e52f09f5793a4505

Analysis

max time kernel
1613s
max time network
1616s
platform
windows7_x64
resource
win7-20220812-es
resource tags

arch:x64arch:x86image:win7-20220812-eslocale:es-esos:windows7-x64systemwindows
submitted
07-02-2023 16:05

Target

steam_api.dll
Size

807KB
MD5

0bd4a59e3be1d8618fef35326de7765d
SHA1

c25afb19159ec1ac4b7265f1397f1fbeb59af580
SHA256

2bfdefc77b83e3ac74588a82381a15de6141fd98c4d204e9e52f09f5793a4505
SHA512

eefd85fecaf86857b7546d829067fa83768b37d4a9c264dda48285db0a3157d32e7258acb5c0dc4eea15ac66eaa5aef7dc01819fcd1cd6ca1ffbc5bd77dd5ad8
SSDEEP

12288:6kqKmpLnAfyElBV+mt3Sm1zFBCHfkM6fPiGgME/Xy2w0EfFF/OLvcvilT4YM:6LLnAfyCl11fPiGgZC2EfXu9lT4YM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2016	1100	rundll32.exe	27
PID 1100 wrote to memory of 2016	1100	rundll32.exe	27
PID 1100 wrote to memory of 2016	1100	rundll32.exe	27
PID 1100 wrote to memory of 2016	1100	rundll32.exe	27
PID 1100 wrote to memory of 2016	1100	rundll32.exe	27
PID 1100 wrote to memory of 2016	1100	rundll32.exe	27
PID 1100 wrote to memory of 2016	1100	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\steam_api.dll,#1
  2⤵
  PID:2016

memory/2016-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download