1c1eda81d9ff3ac630964d345f7c18588e10b0132bb212b77dfd8f02b6397fd7

Resubmissions

20-07-2023 03:52

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20-07-2023 03:52

Target

CrosshairEditor/Freya.dll
Size

281KB
MD5

d5fef36a5ad0e809aad6b7cbe19d1062
SHA1

5adf39cfe296acd1e62618155f1e2ed68ea452df
SHA256

8cd822ca2dd0d9e3f298fb42f5c95ab6ef7ed71b68bfe4ac9e2fdb795760d1fe
SHA512

7c9580d9929c1b4c8f90109808a236113543e41ea3709da9a041c6802666cf18e2e2a827e951267f0fc497605f44bf83e2f5c9824f66917f1a2b0994a6cd8b90
SSDEEP

6144:+3nUjhnjy3aPg+ZQLM7KUAOFLjKjuUjB0r3T+fMMMMMMMMMMMMMMV7MMMMxliqyJ:1CYtQLMwFjuUN43T+fMMMMMMMMMMMMMP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2236	2196	rundll32.exe	28
PID 2196 wrote to memory of 2236	2196	rundll32.exe	28
PID 2196 wrote to memory of 2236	2196	rundll32.exe	28
PID 2196 wrote to memory of 2236	2196	rundll32.exe	28
PID 2196 wrote to memory of 2236	2196	rundll32.exe	28
PID 2196 wrote to memory of 2236	2196	rundll32.exe	28
PID 2196 wrote to memory of 2236	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrosshairEditor\Freya.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrosshairEditor\Freya.dll,#1
  2⤵
  PID:2236