d84ae6a1fe42df7886cbaec78b8433ab93a2ff54b0290754eb7b5315734904bb

Resubmissions

11/10/2023, 00:51

11/10/2023, 00:50

31/01/2023, 09:06

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 00:50

Target

RDR2CHEAT/build/net20/x86/SQLite.Interop.dll
Size

1.1MB
MD5

abac6d5b3848896e47b92abce9ca235f
SHA1

db2f3e072d6647fb5701764d40f9be64d370ab8e
SHA256

493e81543afccd01c25a622ad7a25765b73d16f838fc8df608ce4b2b0550d623
SHA512

a4e87bd8e3a0a1b0fd11001715b0f0199aa03182e321e18e76b35b9494d4b17f6504fcb1afd522d1c9b8d3e902700c64eb4bbdd98c17a426b4d59560c09e9f87
SSDEEP

24576:Waqcs/OGyh7kFlHNmVOVw49igHrTU/s/O5xPFqqw:6OB2lHhVDrT6n4Z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1456	2296	rundll32.exe	28
PID 2296 wrote to memory of 1456	2296	rundll32.exe	28
PID 2296 wrote to memory of 1456	2296	rundll32.exe	28
PID 2296 wrote to memory of 1456	2296	rundll32.exe	28
PID 2296 wrote to memory of 1456	2296	rundll32.exe	28
PID 2296 wrote to memory of 1456	2296	rundll32.exe	28
PID 2296 wrote to memory of 1456	2296	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net20\x86\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net20\x86\SQLite.Interop.dll,#1
  2⤵
  PID:1456