f216c50f1d670afa8f530f85d431580901914c3780b2b6a25fd4cdd0b4c6d8da

Analysis

max time kernel
23s
max time network
28s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-05-2023 17:43

Target

Project 64/Project64 1.6/Plugin/Jabo_Direct3D8.dll
Size

232KB
MD5

ff57f60c58ede6364b980edcb311873b
SHA1

5ec6e231f780d9eafa6ee855e0f4968a7f8c347d
SHA256

05536c82c764f24038bd6f22d47a5427318ce3118bbe1bb798c8309d40f00fcf
SHA512

1e3b5d1bd93cf36dcd862869374d7931eedb1578ceec635c1972f302bd1abaa2d9a63721a2ca9ab4fe1fda8f268f352c70e8a35c8bae91253cb2b4eb1bc7234d
SSDEEP

3072:iRFRjRVY6vNrIFyx4F2wleXaAwYtzYzCklj+VVLCgJVC/VuUBJlmAg0FuxF6lBW3:iVnZ+ZlkwiFAjmLCgC/MUBqAOxFTQA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1384	1636	rundll32.exe	28
PID 1636 wrote to memory of 1384	1636	rundll32.exe	28
PID 1636 wrote to memory of 1384	1636	rundll32.exe	28
PID 1636 wrote to memory of 1384	1636	rundll32.exe	28
PID 1636 wrote to memory of 1384	1636	rundll32.exe	28
PID 1636 wrote to memory of 1384	1636	rundll32.exe	28
PID 1636 wrote to memory of 1384	1636	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Project 64\Project64 1.6\Plugin\Jabo_Direct3D8.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Project 64\Project64 1.6\Plugin\Jabo_Direct3D8.dll",#1
  2⤵
  PID:1384

memory/1384-54-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download
memory/1384-55-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download