d84ae6a1fe42df7886cbaec78b8433ab93a2ff54b0290754eb7b5315734904bb

Resubmissions

11/10/2023, 00:51

11/10/2023, 00:50

31/01/2023, 09:06

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 00:50

Target

RDR2CHEAT/build/net45/x86/SQLite.Interop.dll
Size

1.3MB
MD5

8ee703ae220be11a81d3eaf4eb9106e7
SHA1

db7dc6a2f8887475bea01e7b3612c8d79c3500c1
SHA256

1272e3a910e0c5c6930bfb80e738b5842e447ad42496e3e10abc1380377e45f7
SHA512

4b13b270d175062ac6f69e905a81303089dd0225f4bf7cf149bfc6c54a3ee0ba938729eba00f0ca0bb56790cc8af0c86cac3bc3497791cd7518bbf65db4d6779
SSDEEP

24576:QcbN6B9z+P7j7GA9ZyHAlDvn429TSQ+2f96dpG8MaFXbjxXrVyFNpXO:dNkz+vS8yiv0dcJaFLjtoN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2728	2868	rundll32.exe	29
PID 2868 wrote to memory of 2728	2868	rundll32.exe	29
PID 2868 wrote to memory of 2728	2868	rundll32.exe	29
PID 2868 wrote to memory of 2728	2868	rundll32.exe	29
PID 2868 wrote to memory of 2728	2868	rundll32.exe	29
PID 2868 wrote to memory of 2728	2868	rundll32.exe	29
PID 2868 wrote to memory of 2728	2868	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net45\x86\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net45\x86\SQLite.Interop.dll,#1
  2⤵
  PID:2728