a79b2f9c181baa68b26bcb7a463d7f86fe4eb327faba21356c9bbb6ffb3fa6d8

Analysis

max time kernel
88s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 14:33

Target

Forager v4.1.8-PiviGames.blog/Imguigml.dll
Size

727KB
MD5

8a4108f8d34f771c32eb2235ed288b80
SHA1

5be0fb013fbbfb45ea7408997d309e1ae2212223
SHA256

80e0b8c07e92532891c81677bc86340b935693854a0643cf677f33ed7d29d898
SHA512

dc3705f3f81f9d97a26d8d24a8a914ff722344dfed5c93fdaf9593a652fb97825d610b4de879bcd81045c261da6d4504cfaffcb4cb867972c3e73de40b8d7566
SSDEEP

12288:hGvVz/crtyMgWecmZ6FA7FagDVwEhHCYo2eJIbsW:hGvVctyMgWp/FA77DVwEhHCYo2eOT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4368	4204	rundll32.exe	79
PID 4204 wrote to memory of 4368	4204	rundll32.exe	79
PID 4204 wrote to memory of 4368	4204	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forager v4.1.8-PiviGames.blog\Imguigml.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Forager v4.1.8-PiviGames.blog\Imguigml.dll",#1
  2⤵
  PID:4368