d84ae6a1fe42df7886cbaec78b8433ab93a2ff54b0290754eb7b5315734904bb

Resubmissions

11/10/2023, 00:51

11/10/2023, 00:50

31/01/2023, 09:06

max time kernel
32s
max time network
38s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 00:50

Target

RDR2CHEAT/build/net451/x86/SQLite.Interop.dll
Size

1.3MB
MD5

9d766cf85c7a5b7d7286633cf8a0474b
SHA1

35b41e7064691080d39f4c66a7f3ab5941e9ebdd
SHA256

30d0c8c8be4397e39acdc8e74d9921a8ee24c6a88411a2eb98eace513e216d36
SHA512

087c918420574642af8dec566648ccaa0e25e3a597b3be8204ff82c40e35a48597640f8ad16f24e657ccd7c5e696ab20fbcfec8ab68775c2f3afaa97ba5f4852
SSDEEP

24576:FNLcdPWtKD6oRX4h65LHgljNEVqSN63ju0bLsKq4oOgnUdavUzy/6xfdwVYekB:QWt6X4gH/X50bkSavUzxFwSB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2460	1512	rundll32.exe	28
PID 1512 wrote to memory of 2460	1512	rundll32.exe	28
PID 1512 wrote to memory of 2460	1512	rundll32.exe	28
PID 1512 wrote to memory of 2460	1512	rundll32.exe	28
PID 1512 wrote to memory of 2460	1512	rundll32.exe	28
PID 1512 wrote to memory of 2460	1512	rundll32.exe	28
PID 1512 wrote to memory of 2460	1512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net451\x86\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net451\x86\SQLite.Interop.dll,#1
  2⤵
  PID:2460