1adeedbfd25882c0ae58f5e4271de8417333bd58048611737fd005e7ae92d04e

Analysis

max time kernel
47s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/05/2023, 14:56

Target

Mega-Hack-v5-master/bin/dlls/whitemagic.dll
Size

93KB
MD5

3fe3d4d694cf4738e758748fa73d6e41
SHA1

f0b77de248a7f81eb96ff8b3426235003d999cf9
SHA256

c08d235bf40d4e9f710f51bc561a52f9f57ebbc81159380d86f2c61340a03a40
SHA512

3e1dde43dac57a5084877ebfe5bdb1bb1174304df1588213df8ad6e24a5082a00db5d9fc9c125dbe5908c709dea0ad68bfaf5bfc3249cb4f156a6bea50058cb1
SSDEEP

1536:VsodwSl+kkwCH/uGH55YS9rIwpJrR4oIMMjuY2sWEevdcdf6k72iSb:tSS7kwCfuYjYSTpJHMS6e0f6k72Fb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1652	2032	rundll32.exe	28
PID 2032 wrote to memory of 1652	2032	rundll32.exe	28
PID 2032 wrote to memory of 1652	2032	rundll32.exe	28
PID 2032 wrote to memory of 1652	2032	rundll32.exe	28
PID 2032 wrote to memory of 1652	2032	rundll32.exe	28
PID 2032 wrote to memory of 1652	2032	rundll32.exe	28
PID 2032 wrote to memory of 1652	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mega-Hack-v5-master\bin\dlls\whitemagic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mega-Hack-v5-master\bin\dlls\whitemagic.dll,#1
  2⤵
  PID:1652