d84ae6a1fe42df7886cbaec78b8433ab93a2ff54b0290754eb7b5315734904bb

Resubmissions

11/10/2023, 00:51

11/10/2023, 00:50

31/01/2023, 09:06

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 00:50

Target

RDR2CHEAT/build/net40/x86/SQLite.Interop.dll
Size

1.2MB
MD5

0a6de5fa6ec9a63cabcdd4050daa551b
SHA1

db8cb1009f21c10f2509df1ec0ce736c89a78446
SHA256

29397546eb8dc57f7c0dc4132ca454c0eabb4047eb69eb104baf4603a16829df
SHA512

8755968550fed89235a0d97df8dad807d1bf77198ac3eb354ed6fa258622fe8c7b104116755cdeddfb987801dbc14b5cd08b262031a055928a413ab528d22428
SSDEEP

24576:ovvxkyHje2U7uw3wYgkrNyzqK7dfB/q0qriHzAytKGefcJZnJx:on6mjw7Qkxyt7dZ/q0vzrPx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4656	4668	rundll32.exe	86
PID 4668 wrote to memory of 4656	4668	rundll32.exe	86
PID 4668 wrote to memory of 4656	4668	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net40\x86\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net40\x86\SQLite.Interop.dll,#1
  2⤵
  PID:4656