d84ae6a1fe42df7886cbaec78b8433ab93a2ff54b0290754eb7b5315734904bb

Resubmissions

11/10/2023, 00:51

11/10/2023, 00:50

31/01/2023, 09:06

max time kernel
119s
max time network
151s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 00:50

Target

RDR2CHEAT/build/net46/x86/SQLite.Interop.dll
Size

1.2MB
MD5

1d5041dc5a86b787d9701b78a9e0b121
SHA1

88873d0af22c924869f8c10c46e9b8f765d9b998
SHA256

4870018813eff9a5b050044c5eb639bb3e536ec1cd3ad03da389b83216c0f4d5
SHA512

65b10e3ed76886d6649b9d7a13d9072cc6ee4026632ad588551020df634d065f30691f62b394da96eaf870226dc8272a04b92648c999fc7329573a9e2383af4b
SSDEEP

24576:PRL4z3OFV7DeRuvUJwOB/7UA22Q0XgGtyPmJAvuC8PD/i7pi/sT5B2LOhW:t4jcJzanPXgGR+uC8sp4q2LX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2672	2588	rundll32.exe	29
PID 2588 wrote to memory of 2672	2588	rundll32.exe	29
PID 2588 wrote to memory of 2672	2588	rundll32.exe	29
PID 2588 wrote to memory of 2672	2588	rundll32.exe	29
PID 2588 wrote to memory of 2672	2588	rundll32.exe	29
PID 2588 wrote to memory of 2672	2588	rundll32.exe	29
PID 2588 wrote to memory of 2672	2588	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net46\x86\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net46\x86\SQLite.Interop.dll,#1
  2⤵
  PID:2672